summit v0.4.1 - quality gates, community, docs

Tooling and community release. No scanner behavior changed - the detection engine is untouched since v0.4.0.

Quality gates (all blocking in CI now)

• ruff lint gate (pycodestyle errors/warnings + pyflakes) - zero findings, enforced before tests run
• CodeQL (Python) semantic analysis on every push, PR, and weekly schedule - uploaded to code scanning
• OpenSSF Scorecard weekly + on push; all GitHub Actions pinned to full commit SHAs
• Dependabot watching pip and action dependencies

Community

• first external contributions merged and credited: GoDaddy parked-page signature (@SakarPaisen) and SiteLock WAF fingerprint (@mrvi0) - both with positive and negative tests
• contributors wall added to the README
• welcome bot greets first-time issues and PRs
• CII Best Practices entry submitted (project #15532)

Docs

• GitHub Pages documentation site: https://pennacle-security.github.io/summit/ (Home, Installation, Usage, Checks, Architecture, Security, Contributing)

Verified

• 45 tests, ruff clean, smoke test green, evidence runner 11/11 - all in CI on every push

Authorized testing only.