Prepare repository for public release

- README: attract-mode stills + demo GIF as the hero row, status/warning
  callouts, metrics table, "Contents" index, doc-index table; simplified
  the two-agent workflow diagram (LR -> TD, fewer edges) for GitHub web
- Table-of-contents indexes added to internals.md, porting-notes.md,
  agentic-development.md, AUDIO-PLAN.md
- CI: add Windows/MSYS2 build job, minimal token (contents: read),
  persist-credentials: false, concurrency group; run on main + master.
  validate job regenerates the US ROM-asset symbol file only and configures
  ntsc-final (PAL/JP need a region ROM; no ROM is used in CI)
- .github: SECURITY.md, issue forms + chooser config, PR template,
  labels.yml, dependabot (Actions, monthly)
- Do not track the proprietary SGI IRIX IDO toolchain or SGIImageViewer.exe;
  document in SetupGuide.md / building.md how to obtain IDO for N64 ROM
  builds (the PC port does not need it)
- Stop tracking two committed *.pyc files; drop stale screenshots and a
  redundant .gitignore line; misc doc cross-reference fixes

Claude-Session: https://claude.ai/code/session_01GULf6knbsqfsnW39tMr9WT

docs/dev/HANDOFF-ARCHIVE.md

@@ -1,8 +1,9 @@
 # HANDOFF ARCHIVE — session-by-session narrative
 
-> **Reference only.** Current state, next task, and environment live in
-> `docs/HANDOFF.md`; per-finding detail in `docs/internals.md` §F/§H
-> (indexed at the top of §F). This file is the frozen accumulation of
+> **Reference only.** Current state lives in the [README](../../README.md)
+> "Status" section and `docs/dev/LEVEL-STATUS.md`; per-finding detail is in
+> [`findings.md`](findings.md) §F/§H (indexed at the top of §F). This file
+> is the frozen accumulation of
 > prior sessions' handoff briefs (through session M-11), kept so the
 > reasoning behind a fix is recoverable. Everything below is as-written
 > at the time and may be superseded.