Add executable regression and sanitizer checks, a hardened release profile, CI, fork security and update policies, release notes, and ephemeral Docker development certificates. Assisted-by: OpenAI Codex (GPT-5) Reviewed-by: Eric Ireland
