Prepare workload receipt open-core release

[mESmaC]

What changed

• licenses the core under Apache-2.0 with an explicit NOTICE
• adds customer-first installation, usage, exit-code, privacy, support, and contribution documentation
• completes PyPI metadata and source-distribution contents
• adds python -m yy_workload_receipt support and a regression test
• adds bounded multi-version CI and a release-triggered trusted PyPI publishing workflow
• removes private-spike wording while keeping future paid analysis explicitly unimplemented

Why

The existing workload-receipt spike already had a useful deterministic core and strong content-rejection tests, but it lacked the legal, packaging, documentation, and automation surface required for a responsible public open-core release.

User impact

Users can install a wheel, generate and verify content-free workload receipts through either the wlr command or module entrypoint, understand exit codes and privacy boundaries, and inspect a complete Apache-2.0 source distribution.

This PR does not change repository visibility, publish a PyPI package, create a GitHub release, or add hosted telemetry or paid analysis.

Validation

• python -m ruff check .
• python -m pytest -q — 28 passed
• isolated python -m build — wheel and sdist built
• python -m twine check — both distributions passed
• clean Python 3.11 wheel install, module/console entrypoints, receipt generation, and verification roundtrip
• required LICENSE, NOTICE, README, changelog, support, security, documentation, examples, and tests confirmed in the sdist
• current-tree and Git-history credential-pattern scans returned zero matches
• Claude Opus completed an independent read-only release review and confirmed no actionable blocker after build/security evidence was supplied

Remaining release gates

• all draft-PR CI checks must pass
• configure or verify the PyPI trusted publisher for owner yycore, repository yy-workload-receipt, workflow publish.yml, environment pypi
• intentionally make the repository public only after review
• merge this PR and intentionally publish the v0.1.0 GitHub release to trigger PyPI; neither action is part of this PR