v0.5.1 — readiness reporting + repository truth patch

Patch release with no breaking changes.\n\n- App.Start now reports readiness only after the listener binds.\n- Startup output includes the resolved listening address and correct API-prefixed entity URLs.\n- Bind failures no longer print a false readiness banner.\n- Security, roadmap, Make, coverage, and architecture status surfaces now match v0.5.x.\n- Obsolete worktree scripts were removed.\n- repolint now guards supported-version drift and retired build-script paths.\n\nVerification: make lint and SHORT=1 ./scripts/test-all.sh.