Package for public GitHub release

Add open-source scaffolding and CI; remove Claude-specific dev notes from the
published tree.

- Remove CLAUDE.md from tracking (kept locally, now git-ignored).
- CHANGELOG.md (Keep a Changelog; v1.0 → v1.1.1).
- SECURITY.md (private vuln reporting + operator guidance).
- CONTRIBUTING.md (dev setup, conventions, PR flow).
- .github/: bug + feature issue templates, PR template.
- .github/workflows/ci.yml: byte-compile, validate example config, docker build.
- .github/workflows/release.yml: on a version tag, publish a multi-arch
  (amd64 + arm64) image to GHCR.
- README: license/release/CI badges, prebuilt-image (GHCR) run instructions,
  and a corrected Python-version note (3.9–3.11; netifaces caveat).

Badges and image names use an `OWNER` placeholder to replace with the GitHub
namespace after the repo is created.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitignore

@@ -15,6 +15,7 @@ __pycache__/
 
 # Claude Code
 .claude/
+CLAUDE.md
 
 # Gitea token
 .gitea-token