chore: prepare repository for public release

[jonathanjasare]

Summary

• hardens the verification workflow with explicit read-only permissions and immutable action revisions
• upgrades pytest to the patched 9.0.3 release and refreshes the lockfile
• states the source-only research contract, supported Python versions, and non-affiliation with Fortra Tripwire
• replaces the inaccessible AgentSigma repository link with the author's public article and adds regression coverage

Why

This prepares the repository for a separately approved public-release decision while preserving the frozen TW-001 evaluation. The change addresses workflow supply-chain controls, a known development-dependency advisory, and public-facing identity and support boundaries.

Impact

No detection rule, corpus record, split, metric, or committed result changes. uv run tripwire verify continues to reproduce TP 6, FP 1, TN 36, and FN 11.

Verification

• uv sync --frozen
• uv run tripwire verify
• 30 tests passed
• uv run mypy
• uv run ruff check .
• uv build
• clean source-distribution and wheel installation checks

Publication boundary

This PR does not change repository visibility, create a release, publish a package, deploy anything, or announce the project. Those actions remain separately approval-gated.

[jonathanjasare]

Verification record for commit c9cfd24:

• clean, metadata-free candidate reproduced TP 6, FP 1, TN 36, FN 11
• 30 tests, type checking, linting, and build passed
• source archive SHA-256: 1821138bb0ffd5b33d8cc91d3a4d261d13c1457530da21df81ebd54e66ce586a
• wheel SHA-256: 8819c28aee852b7722ebe896c440738c7410c525d434c50ea511bd27234bc696
• both artifacts installed successfully in separate empty environments

The repository remains private. Public visibility still requires explicit approval.