Make public identity cache-safe and harden repository defaults

[HLLMR]

Closes #4.

What changed

• publish the accepted wall-glyph README banner at a SHA-256-derived URL and test the URL-to-byte binding
• upload and verify the matching wall-glyph GitHub social preview
• pin GitHub-hosted Actions to exact commits and add weekly Actions Dependabot updates
• add one stable CI required aggregator for branch protection
• document private vulnerability reporting and cache-safe asset policy
• carry the accepted closeout State, log, provenance, and projection manifests

Verification

• two independent 117-file projections passed the standalone checker and produced byte-identical complete ledgers (4CD5DAD052948277A5D87DCCBD414DFB2E432866D64C42DC8178C04BE4533522)
• candidate Windows suite: 657 tests passed, 2 skipped
• projection distribution, licensing, identity, and whitespace gates pass
• the live repository social-preview object is byte-identical to the accepted source (5200A1511A781CFE49BAF10177880CFC6E4E18EB8F9A55CA9E17AB4F9B35A312)

The ruleset requires the live CI required result to pass before merge. No release, tag, deployment, Pages, domain, or visibility action is part of this PR.