Beacon v0.2 static product release candidate

[ctharvey]

What changed

• completes Beacon's v0.2 static product loop: safe repository initialization, strict validation, inspect/export workflows, and the frozen five-tool MCP surface
• adds maintained examples, client setup and demo documentation, cross-platform CI, trusted-publishing release automation, and an installed-wheel release journey
• adds four deterministic negative-control mutations so CI proves focused tests fail when critical behavior is deliberately broken
• closes audit findings around secret handling, acknowledgement bounds, export collisions, package metadata, migrated gateway tool leakage, and final-target symlink refusal behavior

Verification

• 572 passed, 9 skipped locally; symlink-capable CI runners executed the locally skipped adversarial cases
• both replacement CI runs passed the full Linux/macOS/Windows × Python 3.12/3.13/3.14 matrix
• quality/security passed, including Ruff, mypy, Bandit, dependency audit, and 4/4 killed deliberate mutations
• package jobs passed wheel metadata/content checks, examples, deterministic exports, and the installed-wheel release journey
• local rebuilt wheel passed the framework-first exact-five stdio journey with socket denial

Release posture

This remains a draft release-candidate PR. No tag or package publication occurred. Remaining release gates are public-index publication/smoke testing and one genuinely unaided developer trial.