Pre-launch hardening: packaging, docs, and public-facing claims

[b32n]

Readiness pass before the first public (HN) announcement. Everything below is verified: build, type-check, all 402 tests, lint (0 errors), website build, and npm pack dry-runs all pass.

Tier 1 — launch blockers

• website: reword the "bundled MCP server" claim — no such server exists in the repo yet
• README: fix a ReferenceError in the sheets quick-start (wb → workbook)
• packaging: add a per-package LICENSE (tarballs shipped none → "no license" on npm)
• packaging: ship dist only, keeping *.test.ts out of published tarballs
• transport-websocket: add a README (npm page was blank)
• remove the phantom immer dependency (never imported) from 4 packages + rollup externals

Tier 2 — credibility

• root package.json: 0.1.0-alpha.1 → 0.3.0 to match all packages/tags
• docs-react: drop the deprecated "Legacy Architecture" public exports and delete the dead files (PresentationEditor/HiddenEditor/PageRenderer/LayoutEngine) plus two orphaned casing-dup files (InputBridge/SelectionOverlay)
• CONTRIBUTING: drop the "& PDF" overclaim (export is left to the host)
• add SECURITY.md

Tier 3 — polish

• add CODE_OF_CONDUCT.md, issue templates, and a PR template
• add engines.node to every published package
• website: exclude internal TODO.md/PLAN.md from the docs bundle (were reachable by direct URL) and unlink them from the docs index
• soften an unbenchmarked 60fps claim and rewrite one AI-slop doc paragraph
• remove a shipped runtime no-op that suppressed an unused-import lint
• README: drop the Weaversuite mention from the inspiration section

Deliberately deferred

• OG/social share image — needs a real 1200×630 banner asset (current is a square logo); switching card type without it would look worse
• docs-core / pagination test coverage — genuine gap (sheets-core and slides-core are well-covered); left as follow-up, no README claim is affected

🤖 Generated with Claude Code