ci: adopt EverOS quality gates

[cyfyifanchen]

Summary

• add a focused core CI workflow: repository safety gates, core tests, and root-package build validation
• reject tracked images/videos and changed files above 640 KB; host the two README paper figures through GitHub User Content instead
• keep the seven maintained core/plugin projects and both README host tables in sync
• add tag-driven PyPI Trusted Publishing and automatic GitHub Release creation for the root package

Closes #10

Verification

• repository asset/media, file-size, and project-inventory checks
• core test suite: 70 passed
• workflow YAML validation
• package boundary is checked in CI and again before every release

[cyfyifanchen]