Prepare repository for public release

- README: attract-mode stills + demo GIF as the hero row, status/warning
  callouts, metrics table, "Contents" index, doc-index table; simplified
  the two-agent workflow diagram (LR -> TD, fewer edges) for GitHub web
- Table-of-contents indexes added to internals.md, porting-notes.md,
  agentic-development.md, AUDIO-PLAN.md
- CI: add Windows/MSYS2 build job, minimal token (contents: read),
  persist-credentials: false, concurrency group; run on main + master.
  validate job regenerates the US ROM-asset symbol file only and configures
  ntsc-final (PAL/JP need a region ROM; no ROM is used in CI)
- .github: SECURITY.md, issue forms + chooser config, PR template,
  labels.yml, dependabot (Actions, monthly)
- Do not track the proprietary SGI IRIX IDO toolchain or SGIImageViewer.exe;
  document in SetupGuide.md / building.md how to obtain IDO for N64 ROM
  builds (the PC port does not need it)
- Stop tracking two committed *.pyc files; drop stale screenshots and a
  redundant .gitignore line; misc doc cross-reference fixes

Claude-Session: https://claude.ai/code/session_01GULf6knbsqfsnW39tMr9WT

docs/dev-process.md

@@ -40,14 +40,14 @@ more room.
 
 Lewis's agents recorded generalisable IDO quirks in a learnings file; later
 agents read it and did better. Our equivalent is
-[`porting-notes.md`](porting-notes.md) — the recurring N64->PC bug classes,
-one screen, each entry an index into the full [`dev/findings.md`](dev/findings.md)
+[`porting-notes.md`](porting-notes.md) — the recurring N64→PC bug classes,
+each entry a terse index into the full [`dev/findings.md`](dev/findings.md)
 log. Every investigation brief links it, and every investigation ends by
 appending any new generalisable quirk.
 
 The classes it currently tracks:
 
-- pointer-width struct growth (32->64) in ROM-serialized or pun-allocated
+- pointer-width struct growth (32→64) in ROM-serialized or pun-allocated
   structs — the dominant class;
 - 16-byte host `Gfx`/`Vtx` vs 8-byte N64 — reservation and copy sizing;
 - big-endian rodata read on a little-endian host: `f32` word-pairs, header