v0.3.1

Added

• Apache License 2.0, CODE_OF_CONDUCT.md, DCO with CI-enforced sign-off,
  CONTRIBUTING.md, SECURITY.md, and a gitleaks + Trivy security-scanning
  pipeline, ahead of open-sourcing this repository.
• .github/workflows/release.yml: creates a GitHub Release for a version tag
  once that tag's PyPI publish and both engine images finish successfully —
  the one place documenting "this tag = these packages + these images",
  since PyPI's release history says nothing about the ghcr.io images.

Changed

• continuo-engine-contract 0.7.0 → 0.7.1: the published wheel now embeds
  LICENSE/NOTICE and declares license metadata, which the 0.7.0 wheel
  omitted. Every exact pin on it — root pyproject.toml and both adapters'
  — updated to match.