Prepare repository for public release

- README: attract-mode stills + demo GIF as the hero row, status/warning
  callouts, metrics table, "Contents" index, doc-index table; simplified
  the two-agent workflow diagram (LR -> TD, fewer edges) for GitHub web
- Table-of-contents indexes added to internals.md, porting-notes.md,
  agentic-development.md, AUDIO-PLAN.md
- CI: add Windows/MSYS2 build job, minimal token (contents: read),
  persist-credentials: false, concurrency group; run on main + master.
  validate job regenerates the US ROM-asset symbol file only and configures
  ntsc-final (PAL/JP need a region ROM; no ROM is used in CI)
- .github: SECURITY.md, issue forms + chooser config, PR template,
  labels.yml, dependabot (Actions, monthly)
- Do not track the proprietary SGI IRIX IDO toolchain or SGIImageViewer.exe;
  document in SetupGuide.md / building.md how to obtain IDO for N64 ROM
  builds (the PC port does not need it)
- Stop tracking two committed *.pyc files; drop stale screenshots and a
  redundant .gitignore line; misc doc cross-reference fixes

Claude-Session: https://claude.ai/code/session_01GULf6knbsqfsnW39tMr9WT

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,71 @@
+name: Bug report (build or run)
+description: A build failure, crash, hang, or rendering/audio/input defect in the PC port
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for filing a report. First, please check:
+
+        - The port is **Phase 2 of 4** — rendering is incomplete and many
+          cosmetic defects are already tracked in
+          [`docs/dev/GRAPHICS-BACKLOG.md`](https://github.com/jkdansereau/goldeneye-pc-port/blob/main/docs/dev/GRAPHICS-BACKLOG.md).
+          Search open issues and that file before filing.
+        - Only the **Windows / MSYS2 MINGW64** build is tested. Linux and
+          macOS are best-effort — build breaks there are expected.
+        - Do **not** attach a ROM, extracted assets, or any game data.
+  - type: input
+    id: commit
+    attributes:
+      label: Commit
+      description: Output of `git rev-parse --short HEAD`
+      placeholder: 311fd012
+    validations:
+      required: true
+  - type: dropdown
+    id: region
+    attributes:
+      label: Region / ROMID
+      options: [ntsc-final, pal-final, jpn-final]
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: OS / environment
+      description: e.g. "Windows 10, MSYS2 MINGW64" or "Ubuntu 22.04, native gcc"
+    validations:
+      required: true
+  - type: dropdown
+    id: stage
+    attributes:
+      label: Which stage fails?
+      options:
+        - Asset extraction
+        - CMake configure
+        - Compile / link
+        - Runtime — crash or hang
+        - Runtime — wrong rendering / audio / input
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened vs. what you expected
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Exact commands, flags (e.g. `-level_09`), and what you did in-game.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: |
+        Paste the terminal error, and `ge007.crash.log` if the port crashed.
+        For a rendering defect, attach a screenshot.
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Build & setup guide
+    url: https://github.com/jkdansereau/goldeneye-pc-port/blob/main/docs/building.md
+    about: Read this first for build/extraction problems — most are covered here.
+  - name: Known rendering defects
+    url: https://github.com/jkdansereau/goldeneye-pc-port/blob/main/docs/dev/GRAPHICS-BACKLOG.md
+    about: Cosmetic / rendering issues already known and tracked. Check before filing.
+  - name: Security vulnerability
+    url: https://github.com/jkdansereau/goldeneye-pc-port/security/advisories/new
+    about: Report memory-safety / build-pipeline vulnerabilities privately, not as a public issue.
+  - name: Rights-holder concern
+    url: https://github.com/jkdansereau/goldeneye-pc-port/blob/main/NOTICE
+    about: If you represent a rights holder, see NOTICE and open an issue titled accordingly.

.github/SECURITY.md

@@ -0,0 +1,41 @@
+# Security Policy
+
+This project is a non-commercial, fan-made research port. It has no server
+component and ships no binaries. The realistic security surface is:
+
+- the PC port executable parsing your own ROM and asset files at load time
+  (a malformed ROM/asset could in principle crash it or worse), and
+- the build/extraction scripts and CI workflow.
+
+## Reporting a vulnerability
+
+Please **do not** open a public issue for a security problem.
+
+Use GitHub's private vulnerability reporting:
+**Security → Report a vulnerability** on this repository
+(<https://github.com/jkdansereau/goldeneye-pc-port/security/advisories/new>).
+
+If that is unavailable, email the maintainer at the address on their GitHub
+profile with `SECURITY` in the subject.
+
+Please include:
+
+- affected version / commit hash (from `git rev-parse HEAD`),
+- OS and how you built (region, `IDO_RECOMP`, MSYS2 vs WSL, …),
+- a minimal reproduction, and
+- the crash log (`ge007.crash.log`) or a stack trace if you have one.
+
+## Scope
+
+In scope: memory-safety bugs in the `port/` layer and PC-port tooling,
+issues in the CI workflow or build scripts, and dependency problems we can
+act on.
+
+Out of scope: bugs inherited unchanged from the upstream
+[GoldenEye 007 decompilation](https://github.com/n64decomp/007) that are not
+made worse by the port (report those upstream), missing-asset or wrong-ROM
+errors, and anything requiring a ROM or assets we do not distribute.
+
+## Supported versions
+
+Only the tip of the default branch is supported. There are no releases yet.

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  # Keep the GitHub Actions used by .github/workflows/ up to date. Opens a PR
+  # when a new version of an action is released; review and merge like any other.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/labels.yml

@@ -0,0 +1,58 @@
+# Source of truth for this repo's issue/PR labels.
+# GitHub does not read this file automatically. Apply it with the gh commands
+# in the comment block at the bottom, or wire up a label-sync action later.
+#
+# `bug` and `documentation` are GitHub defaults and are kept as-is.
+
+- name: bug
+  color: d73a4a
+  description: Something is broken
+
+- name: rendering
+  color: 5319e7
+  description: Graphics / fast3d / RSP output defect (see docs/dev/GRAPHICS-BACKLOG.md)
+
+- name: audio
+  color: 1d76db
+  description: Sound / music / libaudio (Phase 3)
+
+- name: input
+  color: 0e8a16
+  description: Keyboard / mouse / controller
+
+- name: build
+  color: fbca04
+  description: CMake / MSYS2 / toolchain / CI
+
+- name: asset-extraction
+  color: c2e0c6
+  description: ROM asset extraction pipeline (scripts/, tools/extractor)
+
+- name: upstream
+  color: bfd4f2
+  description: Originates in the n64decomp/007 decompilation, not the port — may belong upstream
+
+- name: abi-64bit
+  color: fef2c0
+  description: 32-to-64-bit pointer-width / struct-layout issue (the #ifdef PORT exception)
+
+- name: needs-repro
+  color: e99695
+  description: Cannot reproduce yet; waiting on more detail
+
+- name: wontfix
+  color: ffffff
+  description: Out of scope or working as intended
+
+# Apply with the GitHub CLI (run once, after the repo exists):
+#
+#   gh label create rendering       -c 5319e7 -d "Graphics / fast3d / RSP output defect"
+#   gh label create audio           -c 1d76db -d "Sound / music / libaudio (Phase 3)"
+#   gh label create input           -c 0e8a16 -d "Keyboard / mouse / controller"
+#   gh label create build           -c fbca04 -d "CMake / MSYS2 / toolchain / CI"
+#   gh label create asset-extraction -c c2e0c6 -d "ROM asset extraction pipeline"
+#   gh label create upstream        -c bfd4f2 -d "Originates in the decompilation, not the port"
+#   gh label create abi-64bit       -c fef2c0 -d "32-to-64-bit pointer-width / struct-layout issue"
+#   gh label create needs-repro     -c e99695 -d "Cannot reproduce yet; waiting on more detail"
+#
+# `bug` and `wontfix` already exist as GitHub defaults.

.github/pull_request_template.md

@@ -0,0 +1,37 @@
+<!--
+Read CONTRIBUTING.md first. This is a faithfulness-focused port; the ground
+rules there are non-negotiable.
+-->
+
+## What this changes
+
+<!-- One or two sentences. Link the issue it closes: "Closes #123". -->
+
+## Why
+
+<!-- The reasoning, not just the diff. What was wrong / missing? -->
+
+## Scope check
+
+- [ ] No changes under `src/` or `include/` — **or** the only changes are the
+      narrow `#ifdef PORT` ABI exception (CONTRIBUTING.md rule 2), and each is
+      documented in `docs/porting-notes.md` / `docs/dev/findings.md`.
+- [ ] `Makefile`, `tools/`, `rsp/`, `ld/` untouched (N64 build).
+- [ ] If `CMakeLists.txt` `REGION_DEFS` changed, it still matches the N64
+      `Makefile` per-region macro set exactly.
+
+## Verification
+
+<!-- What you actually ran. Delete lines that don't apply. -->
+
+- [ ] `./build-pc.sh ntsc-final` — clean configure + link
+- [ ] Crash-free run of at least one level (`-level_09`)
+- [ ] Single-frame `GE_PCDUMP` diff against the committed golden — no
+      unexpected change
+- [ ] pal-final / jpn-final also configured
+
+Platform tested: <!-- e.g. Windows 10 / MSYS2 MINGW64 -->
+
+## Notes for the reviewer
+
+<!-- Anything uncertain, follow-ups, or areas that need a closer look. -->

.github/workflows/ci.yml

@@ -2,26 +2,43 @@ name: CI
 
 on:
   push:
-    branches: [ master ]
+    branches: [ main, master ]
     paths-ignore: [ '**.md', 'docs/**', 'LICENSE', 'NOTICE' ]
   pull_request:
+    paths-ignore: [ '**.md', 'docs/**', 'LICENSE', 'NOTICE' ]
   workflow_dispatch:
 
-# The full port build needs assets extracted from a copyrighted ROM, which CI
-# does not have. This job validates everything that does NOT depend on those
-# assets: the PC-port tooling, the generated ROM-asset symbol files, and a
-# CMake configure of all three regions (which checks REGION_DEFS, the source
-# list, and that SDL2 / zlib / OpenGL are discoverable).
+# Minimal token: CI only reads the repo and uploads build artifacts, neither of
+# which needs write access. Fork PRs run untrusted build scripts on the runner,
+# so keep the granted scope as small as possible and never expose secrets here.
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+# Two jobs:
 #
-# This is a configure-only smoke test. It does NOT compile or run the port, and
-# it running on ubuntu is NOT a statement that the port builds or works on
-# Linux — it has only ever been built and tested on Windows (MSYS2).
+#   validate      — ubuntu, configure-only. Byte-compiles the tooling,
+#                   regenerates the US ROM-asset symbol file, and CMake-
+#                   configures ntsc-final (REGION_DEFS, the source list, and
+#                   that SDL2 / zlib / OpenGL are discoverable). No ROM is used.
+#                   Does NOT compile; running on ubuntu is NOT a claim the port
+#                   works on Linux.
+#
+#   windows-build — windows/MSYS2, the real supported platform. Compiles and
+#                   links the full executable. Neither the ROM nor extracted
+#                   assets are needed to BUILD (they are runtime-only), so CI
+#                   builds but never runs the port.
 
 jobs:
   validate:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         run: |
@@ -31,17 +48,61 @@ jobs:
       - name: Byte-compile Python tooling
         run: python3 -m compileall -q scripts tools_pc
 
-      - name: Regenerate ROM-asset symbol files
+      # US only. gen_romassets.py resolves every symbol for the US region from
+      # the committed CSVs with no ROM present; PAL/JP each need a handful of
+      # region-specific prop/font offsets that only come from that region's ROM
+      # (see docs/building.md — PAL/JP builders generate romassets_e/j.s
+      # locally). No ROM is used or required here.
+      - name: Regenerate ROM-asset symbol file (US)
         run: |
           python3 scripts/gen_romassets.py u
-          python3 scripts/gen_romassets.py e
-          python3 scripts/gen_romassets.py j
           git diff --stat -- port/src/romassets_u.s
 
-      - name: CMake configure (all regions)
-        run: |
-          for r in ntsc-final pal-final jpn-final; do
-            echo "::group::configure $r"
-            cmake -S . -B "build-$r" -DROMID="$r"
-            echo "::endgroup::"
-          done
+      - name: CMake configure (ntsc-final)
+        run: cmake -S . -B build-ntsc -DROMID=ntsc-final
+
+  # Real Windows (MSYS2 MINGW64) build — the only platform the port is
+  # developed and tested on. This compiles and LINKS the full executable.
+  #
+  # No ROM and no extracted assets are needed to build: the compiled asset set
+  # is a handful of committed pure-data .c files plus the generated
+  # address-constant romassets_<region>.s. The ROM (.z64) and the ROM-derived
+  # blobs are runtime-only dependencies — CI cannot run the game, only build it.
+  windows-build:
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: msys2/setup-msys2@v2
+        with:
+          msystem: MINGW64
+          update: true
+          install: >-
+            mingw-w64-x86_64-toolchain
+            mingw-w64-x86_64-cmake
+            mingw-w64-x86_64-SDL2
+            mingw-w64-x86_64-zlib
+            mingw-w64-x86_64-python
+
+      - name: Regenerate ROM-asset symbol file (US)
+        run: python scripts/gen_romassets.py u
+
+      - name: Build (ntsc-final)
+        run: ./build-pc.sh ntsc-final
+
+      - name: Upload executable
+        uses: actions/upload-artifact@v4
+        with:
+          name: ge007-ntsc-final
+          path: build-pc/ge007*
+          if-no-files-found: error
+          retention-days: 14
+
+      # CI builds the executable but does not run it — running the port needs a
+      # ROM, which CI does not provide. Runtime checks (the -level_09 soak, a
+      # golden-frame diff) would run on a self-hosted runner instead. Not planned.