Harden production operations and release workflows

[captainpacket]

Summary

• atomically write generated payload and audit files with owner-only permissions
• add bounded retries only for idempotent Forward API operations
• embed release version, commit, and build date in the CLI
• tighten CI/release workflow permissions, pin actions, and add race/vulnerability checks
• put the workflow decision diagram first and shorten the README
• add security reporting and human-only contributor attribution guidance

Safety

• create POSTs remain single-attempt to avoid duplicate side effects
• removal gates and blast-radius controls are unchanged and documented up front
• no GitHub repository settings, branch protection, or admin/security features are changed
• published history is not rewritten

Validation

• make ci
• actionlint .github/workflows/ci.yml .github/workflows/release.yml
• release-style build and awssync --version smoke test