chore: prepare the secure, cost-capped v0.1.0 release

[Atomics-hub]

What this ships

• prepares the bounded v0.1.0 alpha changelog and tag-only attested release path
• patches all 13 currently reported site dependency advisories; local full and production npm audits are both zero
• adds a blocking full dependency audit to protected CI and release verification
• groups routine Dependabot updates monthly, limits them to one PR per ecosystem, and ignores automatic major bumps
• removes duplicate full CI after merge and suppresses duplicate npm audit requests
• records the live repository guardrails: seven-day artifacts/logs and caches, 10 GB cache hard cap, all-external fork approval, and full-SHA Action pinning

Verification

• ruff check, format check, mypy, and frozen benchmark validation: pass
• pytest: 158 passed, 1 Docker-gated skip, 80.25% branch coverage
• clean npm ci, full audit, production audit, build, 3 site tests, and lint: pass; 0 vulnerabilities
• desktop and mobile Playwright QA: pass; no console errors, overflow, or overlap
• actionlint and zizmor: pass; no findings
• independent release/cost red-team: GO, no P0/P1 findings

Cost boundary

This is intentionally one consolidated protected PR run. Standard GitHub-hosted runners are used; no larger runner or paid service is introduced. Post-merge full CI is removed, artifacts and logs retain for seven days, caches are capped at the included 10 GB with seven-day retention, stale closed-PR caches/artifacts were deleted, and every external fork workflow requires maintainer approval.

Claim limits

The self-owned fixture is infrastructure proof only. The frozen historical benchmark remains 0/20, outside maintainer validation is 0, reuse intent is 0, and complete all-attempt model cost is not yet measured. This PR does not claim accuracy, demand, revenue, or hosted readiness and does not publish to PyPI.