docs: establish truthful public repository trust

[bymilon]

Outcome

Repositions the public repository as a credible demand-validation build before outreach.

Changes

• product-first README with real website evidence and explicit capability boundaries
• contribution, security, and source-available terms
• research-first landing copy; product pilot and price clearly labelled hypotheses
• GitHub metadata, private vulnerability reporting, and protected main configured

Validation

• bun run check
• Impeccable detector: zero findings
• desktop and mobile screenshots inspected
• independent truthfulness and public-repository audits