Prepare repository for public release

- README: attract-mode stills + demo GIF as the hero row, status/warning
  callouts, metrics table, "Contents" index, doc-index table; simplified
  the two-agent workflow diagram (LR -> TD, fewer edges) for GitHub web
- Table-of-contents indexes added to internals.md, porting-notes.md,
  agentic-development.md, AUDIO-PLAN.md
- CI: add Windows/MSYS2 build job, minimal token (contents: read),
  persist-credentials: false, concurrency group; run on main + master.
  validate job regenerates the US ROM-asset symbol file only and configures
  ntsc-final (PAL/JP need a region ROM; no ROM is used in CI)
- .github: SECURITY.md, issue forms + chooser config, PR template,
  labels.yml, dependabot (Actions, monthly)
- Do not track the proprietary SGI IRIX IDO toolchain or SGIImageViewer.exe;
  document in SetupGuide.md / building.md how to obtain IDO for N64 ROM
  builds (the PC port does not need it)
- Stop tracking two committed *.pyc files; drop stale screenshots and a
  redundant .gitignore line; misc doc cross-reference fixes

Claude-Session: https://claude.ai/code/session_01GULf6knbsqfsnW39tMr9WT

docs/building.md

@@ -35,10 +35,13 @@ versions and hashes.
 ### Asset extraction (decompilation toolchain)
 
 The extraction scripts need `binutils-mips-linux-gnu` (or an equivalent MIPS
-binutils), `make`, `git`, `python3`, and `qemu-irix` for the IRIX IDO
-compiler. On Windows this is easiest under WSL or a Linux VM. Full details and
-alternatives (Docker, the recompiled IDO toolchain) are in
-[`SetupGuide.md`](SetupGuide.md).
+binutils), `make`, `git`, and `python3`. They build a small host-compiled
+`tools/extractor` and slice blobs straight out of the ROM — **no IDO / IRIX
+toolchain is involved in extraction or in the PC build.** (The IDO toolchain is
+only needed to build the N64 ROM itself, and its proprietary SGI binaries are
+not distributed here — see [`SetupGuide.md`](SetupGuide.md) "Recompile IDO".)
+On Windows this is easiest under WSL or a Linux VM. Full details and
+alternatives (Docker) are in [`SetupGuide.md`](SetupGuide.md).
 
 ---