Prepare repository for public release

- README: attract-mode stills + demo GIF as the hero row, status/warning
  callouts, metrics table, "Contents" index, doc-index table; simplified
  the two-agent workflow diagram (LR -> TD, fewer edges) for GitHub web
- Table-of-contents indexes added to internals.md, porting-notes.md,
  agentic-development.md, AUDIO-PLAN.md
- CI: add Windows/MSYS2 build job, minimal token (contents: read),
  persist-credentials: false, concurrency group; run on main + master.
  validate job regenerates the US ROM-asset symbol file only and configures
  ntsc-final (PAL/JP need a region ROM; no ROM is used in CI)
- .github: SECURITY.md, issue forms + chooser config, PR template,
  labels.yml, dependabot (Actions, monthly)
- Do not track the proprietary SGI IRIX IDO toolchain or SGIImageViewer.exe;
  document in SetupGuide.md / building.md how to obtain IDO for N64 ROM
  builds (the PC port does not need it)
- Stop tracking two committed *.pyc files; drop stale screenshots and a
  redundant .gitignore line; misc doc cross-reference fixes

Claude-Session: https://claude.ai/code/session_01GULf6knbsqfsnW39tMr9WT

.gitignore

@@ -76,6 +76,12 @@ ge007.ini
 !build/test.c
 !notes/StyleGuide.md
 #tools
+# Original SGI IRIX 5.3 IDO toolchain (proprietary SGI binaries) and the SGI
+# image viewer are NOT distributed with this repo. They are only needed to
+# build the N64 ROM or to regenerate tools/ido5.3_recomp; the PC port does not
+# use them. See docs/SetupGuide.md "Recompile IDO" for how to obtain them.
+tools/irix/
+tools/SGIImageViewer.exe
 tools/extractor/*.o
 tools/extractor/extractor
 tools/aaa_rip/main.o
@@ -117,7 +123,6 @@ assets/obseg/em/data/under.seg
 
 scripts/local/
 scripts/make/local/
-scripts/__pycache__/generate_prop_model_c.cpython-310.pyc
 
 # PC port debug/session artifacts
 _run.log