docs: record public portfolio publication

[Oneiros667]

What changed

• record that Time Manager is now a public source-only portfolio repository
• bind the publication outcome to the reviewed merge commit and exact hosted Quality evidence
• record anonymous-clone verification and the active main-ruleset, vulnerability-reporting, Dependabot, and secret-scanning controls
• retain the open manual accessibility, usability, browser/device, and independent-security gates

Why

The publication audit still described visibility and post-public controls as pending after the owner explicitly authorized and completed source-only publication.

Validation

• anonymous credential-free clone matched public main at 0e11d2792dfa9d750f2c90b30ec6d2d59fad9943
• public README, Apache-2.0 license, and synthetic assets were present
• repository hygiene, lock consistency, and whitespace checks passed
• the protected PR Quality workflow provides exact-head hosted verification

No application behavior, deployment, or validation claim changes.