Launch readiness: community files, PyPI release workflow, CI matrix

[nickklos10]

Summary

Fixes the Tier 1 launch blockers identified in the repo audit: internal AI planning artifacts in the public tree, missing community-health files, no path to PyPI (the README badge currently 404s), and single-version CI with no lint.

Changes

• Removed docs/superpowers/ — internal implementation plans/specs don't belong in the public tree (they remain in git history).
• SECURITY.md — private reporting via GitHub security advisories + email fallback. Also fixes the dangling SECURITY.md reference that was already in CONTRIBUTING.
• CODE_OF_CONDUCT.md — Contributor Covenant v2.1.
• Issue templates + PR template — bug report and feature request forms, plus a PR checklist matching the CONTRIBUTING conventions.
• release.yml — publishes to PyPI via trusted publishing (OIDC, no stored tokens) when a GitHub Release is published. Build and publish are separate jobs; only the publish job gets id-token: write.
• eval.yml — Python 3.11/3.12/3.13 matrix, separate ruff check lint job, matrix-suffixed report artifacts.
• CONTRIBUTING — replaced the internal-tooling review bullet with standard maintainer-review language.
• Ruff cleanup — removed 9 unused imports (F401) so the new lint job starts green.

Manual steps after merge (owner only)

1. Register the trusted publisher on PyPI (one time): pypi.org/manage/account/publishing → "Add a new pending publisher" → PyPI project name querypilot, owner nickklos10, repository QueryPilot, workflow release.yml, environment pypi.
2. Cut v0.1.0: GitHub → Releases → "Create a new release" → tag v0.1.0, target main, paste the 0.1.0 CHANGELOG section. Publishing the release triggers the PyPI upload and makes the README PyPI badge live. It also fixes the CHANGELOG's existing v0.1.0 tag link, which currently points at a tag that doesn't exist.
3. Enable private vulnerability reporting: Settings → Code security → "Private vulnerability reporting" — SECURITY.md and the issue-template contact link point there.

Testing

• ruff check src tests clean locally.
• pytest + the smoke eval gate run in CI on this PR across all three Python versions (local machine is Python 3.9, below the package's 3.11 floor).

🤖 Generated with Claude Code