docs: prepare public distribution path

[saagpatel]

What

• Documents GitHub Releases as the supported public distribution channel and adds a PyPI activation checklist.
• Makes PyPI upload explicitly opt-in via scripts/release.sh --publish-pypi and moves make release to artifact preparation only.
• Adds PyPI-ready package metadata plus tests that guard the public distribution policy.

Why

• The project is public now, so the install and publishing story needs to be clear and hard to misuse.
• PyPI should remain a deliberate future activation step, not something a local credential can trigger accidentally.

How

• Updated release helper defaults, Makefile targets, README/release docs, changelog, issue template, and pyproject metadata.
• Added a focused distribution-policy test for package metadata, PyPI opt-in behavior, and docs alignment.

Testing

• ruff check src/ tests/
• python3 -m pytest tests/test_distribution_policy.py tests/test_versioning.py -q -p no:cacheprovider
• python3 -m pytest -q -p no:cacheprovider
• bash scripts/release.sh
• make release
• ./dist/audit.pyz --help

Performance Impact

• None expected; packaging/docs/test-only changes.

Risk / Notes

• PyPI publishing remains inactive until the project owner configures PyPI/Trusted Publishing or credentials and explicitly runs make publish-pypi.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1ebd0e6738

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restore executable bit on release helper

With this commit the file mode changes from 100755 to 100644, so the documented direct invocation path (scripts/release.sh --publish-pypi in the updated release docs and the script's shebang-based usage) now fails with Permission denied on a normal checkout. Either keep the helper executable or make all docs/targets consistently invoke it via bash.

Useful? React with 👍 / 👎.