Prepare repository for public release

- README: attract-mode stills + demo GIF as the hero row, status/warning
  callouts, metrics table, "Contents" index, doc-index table; simplified
  the two-agent workflow diagram (LR -> TD, fewer edges) for GitHub web
- Table-of-contents indexes added to internals.md, porting-notes.md,
  agentic-development.md, AUDIO-PLAN.md
- CI: add Windows/MSYS2 build job, minimal token (contents: read),
  persist-credentials: false, concurrency group; run on main + master.
  validate job regenerates the US ROM-asset symbol file only and configures
  ntsc-final (PAL/JP need a region ROM; no ROM is used in CI)
- .github: SECURITY.md, issue forms + chooser config, PR template,
  labels.yml, dependabot (Actions, monthly)
- Do not track the proprietary SGI IRIX IDO toolchain or SGIImageViewer.exe;
  document in SetupGuide.md / building.md how to obtain IDO for N64 ROM
  builds (the PC port does not need it)
- Stop tracking two committed *.pyc files; drop stale screenshots and a
  redundant .gitignore line; misc doc cross-reference fixes

Claude-Session: https://claude.ai/code/session_01GULf6knbsqfsnW39tMr9WT

docs/SetupGuide.md

@@ -88,9 +88,23 @@ This project can compile the ROM's C code in one of two ways, controlled by the
   [qemu-irix](https://github.com/n64decomp/qemu-irix/releases) user-mode emulator instead. Slower, but useful as a
   lower-risk reference if you ever suspect the recompiled toolchain is misbehaving.
 
+> **The IRIX IDO binaries are not distributed with this repository.** They are
+> proprietary SGI software and only ever ran on IRIX/MIPS. Neither `tools/irix/`
+> nor `tools/SGIImageViewer.exe` is committed here; the **PC port does not need
+> them at all** (asset extraction uses `tools/extractor`, and the port itself
+> builds with CMake + your host compiler). You only need the IDO toolchain to
+> build the actual **N64 ROM** or to regenerate `tools/ido5.3_recomp`. To get it:
+> obtain the IDO 5.3 tree from an IRIX 5.3 installation, from
+> [`decompals/ido-static-recomp`](https://github.com/decompals/ido-static-recomp)
+> (which documents where its input binaries come from), or from the N64
+> decompilation community, and place it at `tools/irix/root/` (with `cc` etc.
+> under `tools/irix/root/usr/bin/`). `tools/SGIImageViewer.exe` is an optional
+> convenience only.
+
 The recompiled toolchain isn't checked into git — it's generated locally the first time it's needed, from the
-original IDO binaries in `tools/irix/root`. A plain `make` from the repo root builds it automatically if it's
-missing (wired up via `tools/Makefile`), so most people never need to run this step by hand. To build it explicitly
+original IDO binaries in `tools/irix/root` (see the note above on obtaining those). A plain `make` from the repo
+root builds it automatically if it's missing (wired up via `tools/Makefile`), so most people never need to run
+this step by hand. To build it explicitly
 (e.g. to watch its own build output, or force a rebuild after changing it):
 
 ```bash