Marketplace readiness: assets, public README, no-telemetry commitment, security once-over

[rappdw]

Cluster for the remaining pre-beta polish (ROADMAP_1.0.md 0.9.0 items 3–4):

• 128px marketplace icon (activity-bar SVG doesn't qualify), categories/keywords, gallery banner color.
• README restructured for a marketplace audience: what/why/quickstart on top; author/dev content moves down or to CONTRIBUTING.
• Privacy: explicit "no telemetry, ever" statement in README + marketplace description (currently an omission, should be a commitment).
• Security once-over for public exposure: webview CSP audit across all three webviews, message-validation sweep (the openExternal scheme-guard pattern applied everywhere a webview message reaches a privileged API), .vscodeignore audit so no dev artifacts ship.

Size S/M. Last item before the beta publish.