[codex] prepare public launch surface

[workingclassbuddha]

Summary

• Add Public Alpha status, launch boundaries, Apache-2.0 license metadata, and public-facing security/contribution docs.
• Add issue and pull request templates plus a launch checklist for the visibility switch.
• Mark the demo signing key as a public development issuer and keep CI on the current JavaScript action runtime.
• Add a public launch readiness test so the repo does not lose this surface accidentally.

Verification

• pnpm vitest run tests/public-launch.test.ts
• pnpm test
• pnpm typecheck
• git diff --check

Launch Note

The repository is still private. This PR prepares the public surface; it does not change GitHub visibility.