Meta-hardening: legibility, security, invariant tests (zero runtime change)

[LalaSkye]

Scope

Meta-hardening pass: legibility, security policy, and invariant test coverage.

Constraint: ZERO runtime semantic change. No edits to stop_machine.py, gate.py, rules.py, envelope_parser.py, or primitives/*.

Changes

A) New files

File	Purpose
SECURITY.md	Security disclosure policy
docs/runtime-trace.md	Runtime trace walkthrough
docs/architecture-diagram.md	ASCII architecture diagram
tests/__init__.py	Package init for test discovery
tests/test_invariant_enforcement.py	Structural invariant tests

B) Modified files

File	Change
CHANGELOG.md	Added meta-hardening entry
.github/workflows/ci.yml	Added Run invariant tests step (python -m pytest tests/ -v)

Invariant tests cover

• No StopMachine class in primitives/
• No Gate class in v0 primitive folders
• No runtime imports from analysis/, docs/, artifacts/, examples/
• stop_machine.py defines exactly {ALLOW, HOLD, DENY} states
• Gate file contains SILENCE exit
• Primitive folders exist and are non-empty
• LICENSE and README.md exist at repo root

Verification

• All 7 commits verified
• 572 additions, 0 deletions
• CI triggers on PR open (will run matrix tests + invariant suite)
• Branch is able to merge cleanly into main