Harden public hygiene and verification honesty

[zaler23]

Summary

• harden public/API/LLM diagnostics against endpoint, local path, token fragment, and raw request/response leakage
• remove obsolete historical audit/landing docs from the public tree
• tighten verification honesty so text obligations, diagnostic-only results, replay records, and source lineage cannot self-certify stronger evidence than observed
• expand public tree/package hygiene checks for runtime artifacts and generated files

Validation

• git diff --check
• UV_PROJECT_ENVIRONMENT=/tmp/cogev-subtraction-venv PYTEST_ADDOPTS="-p no:cacheprovider" make test PYTHON="uv run --frozen --extra test python" → 679 passed, 1 skipped
• UV_PROJECT_ENVIRONMENT=/tmp/cogev-subtraction-venv uv run --frozen --extra test python -B scripts/cogev.py doctor --scope all → 49/49 checks passed
• scripts/package_clean.sh
• prepublish scans for runtime artifacts, local absolute paths, obvious secrets, and forbidden verification/final-gate additions