docs: make public artifacts independently reviewable

[RobLe3]

Summary

Closes the public-artifact portability gap tracked in #174 and supplies the review packet required by #41.

• defines the public product/research versus private development-method boundary
• adds public continuation and security guidance suitable for independent review or maintenance
• removes private repository, internal path and private-loop dependencies from public specifications and research records while preserving technical decisions and experiment evidence
• publishes a generated public-only repository manifest
• makes the deterministic specification archive include license, governance, security, contribution and continuation material
• adds a fail-closed closure checker with whole-repository audit mode
• adds a peer-draft evidence matrix and deterministic source/XML/text/HTML review bundle
• removes the private legal-review lane from the protocol participation campaign
• replaces the one real workstation output path in a public tool with an explicit CLI output

The published negative fixture containing /Users/operator/private-build remains byte-stable because released parity contracts pin its digest; the checker exempts that exact fixture and has a regression test for the exception.

Boundaries

• no wire, profile, registry, package version or protocol-suite change
• no publication of private prompts, orchestration, work selection, operational history or credentials
• no deployment, package publication, Internet-Draft submission or IANA request
• implementation evidence remains non-normative and same-project SDK parity is not called independent adoption

Local evidence

• python3 tools/generate_implementations.py --check
• PYTHONPATH=tools /tmp/iicp-tools-venv/bin/python -m unittest discover -s tools -p 'test_*.py' — 214 passed, 7 skipped
• python3 tools/check_spec_release_integrity.py — 185 pinned artifacts
• python3 tools/test_spec_release.py — deterministic archive passed
• python3 tools/check_public_artifact_closure.py --all-public — 439 public text artifacts passed
• ./tools/run_native_framing_conformance.sh — Rust, Python and TypeScript fixture tests passed
• pinned Internet-Draft build produced XML, text and HTML
• python3 tools/build_standards_review_bundle.py — deterministic bundle SHA-256 666a9ca12fe32c19ebf39d730fc405705067277f4ee431244d1d943ed9283024
• strict public-prose check on the new review/governance/security documents — 0 findings

Sentrux has no rules or baseline in this standalone repository, so no Sentrux pass is claimed and no baseline was created merely to make the gate green.

Related implementation documentation PRs

• docs: make public maintenance boundary self-contained iicp-client-python#99
• docs: make public maintenance boundary self-contained iicp-client-typescript#87
• docs: make public maintenance boundary self-contained iicp-client-rust#99
• docs: make public maintenance boundary self-contained iicp-web-node#17