release: prepare v0.1.0

[Alex-ghost599]

Summary

• prepare the Agent-native public v0.1.0 documentation, package metadata, and release process
• add a stable pre-registerable Feishu OAuth loopback redirect with strict fail-closed validation and explicit no-browser handoff
• add tag-only release automation with lock-first execution, one validated artifact set, checksums, provenance attestation, GitHub Release, and default-disabled trusted PyPI publishing
• extend public-boundary checks with publishable-HEAD Git identity policy and semantic workflow contracts

Agent UX and evidence boundary

• Plan is explicitly not an executed Task; execution requires a valid Agent review artifact
• self-review remains declared as self_reviewed and cannot impersonate independent review
• receipts provide typed next actions plus JSON/Markdown user handoff
• public CI uses synthetic/mocked evidence and makes no live-tenant validation claim

Verification

• 337 tests passed; coverage 91.46%
• Ruff, mypy, build, twine, pip-audit, gitleaks (57 commits), privacy history/identity, actionlint, and diff check passed
• clean wheel installation, CLI/version smoke, IPv4/IPv6 callback probes, and producer-to-consumer SHA256 artifact simulation passed
• independent validation-only re-review: PASS (0 Blocker / 0 Important / 0 Minor)

Release boundary

• PyPI publishing remains skipped unless trusted publishing and the protected pypi environment are explicitly configured
• real tag workflow, attestation, and GitHub Release remain to be verified after the develop-to-main release PR and annotated tag
• existing author metadata on retained public task branches is recorded as a bounded residual risk; publishable HEAD uses GitHub noreply

Closes #41
Closes #42