build: automate releases and repository checks

[keys-i]

What changed

• Adds Release-plz semantic versioning and a serialized, recoverable release pipeline for four native wheels.
• Publishes through PyPI Trusted Publishing and attaches the same wheels, checksums, and GitHub provenance to each GitHub Release.
• Adds per-tool Hyperfine benchmarks, CodeQL, dependency review, issue forms, contributor policies, and the pull request template.
• Moves benchmark material to benches/, human documentation to docs/, and substantial release logic to scripts/.
• Keeps all 39 third-party research clones local and ignored; only pinned research evidence is documented.

Closes #2

Verification

• cargo test --locked — 5 unit and 3 CLI tests passed.
• cargo fmt --all --check
• cargo clippy --all-targets --locked -- -D warnings
• cargo build --release --locked
• Native wheel installed in a clean environment; fetch --json and games list --json passed.
• actionlint, ShellCheck 0.11.0, Bash syntax/self-test, and Zizmor 1.29.0 pedantic passed.
• 100-run local benchmark: fetch 1.6 ± 0.1 ms / 336,032 B; games 2.1 ± 0.2 ms / 354,496 B.
• Mandatory fallback gate: VERDICT: PASS (fixed gatekeeper alias was unavailable).

Review

• Public behavior, help, and relevant docs are updated.
• New authorization and recovery paths have observable checks.
• No unrelated files, generated output, secrets, or research clones are included.
• I will follow the Code of Conduct.

Release gate and rollback

Keep this PR draft and do not merge until the PyPI pending trusted publisher exists with project keys-tools, owner keys-i, repository tools, workflow release.yml, and environment pypi. GitHub has no Python package registry, so GitHub distribution uses Release assets rather than GitHub Packages.

Rollback is a revert of commit 18b1b52 plus disabling the pypi environment and release workflow. No UI changed, so UI evidence is not applicable.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[keys-i]

Superseded by safe non-release branch PR #9; closing unmerged prevents release authorization.