init

chore: full ecosystem refactor — legal, CI/CD, badges, docs

- Add MIT LICENSE, SECURITY.md, docs/LEGAL.md (warranty disclaimer)
- Create README.md with live badges and disclaimer
- Add author, keywords, repository, homepage, funding to package.json
- New tools/changelog.ts — automated conventional-commit changelog (zero deps)
- New tools/version.ts — VERSION → package.json sync
- Add root scripts: version:sync, version:check, changelog, release:prep
- Add ci.yml — Bun caching, typecheck, test, build, artifact upload
- Add release.yml — dual trigger, auto changelog commit, GitHub Release, npm publish
- Add version-check.yml — VERSION single-source-of-truth enforcement
- Add codeql.yml — weekly TypeScript security scan
- Add .npmrc — @astrake scope, git-tag-version=false
- Expand .gitignore
- Add docs: PROJECT.md, ARCHITECTURE.md, DEVELOPMENT.md, RELEASES.md,
            AI_AGENT_GUIDE.md, LEGAL.md
- Update AGENTS.md with surface isolation rules and release workflow
- Create CHANGELOG.md (0.1.0 initial release)