Prepare PreviewMD for open source

[ashtree74]

Summary

• establish PreviewMD as Adam Jesionkiewicz's independent Apache-2.0 project, with Astrography named only as the current macOS binary distributor
• add welcoming contributor documentation, founder-led governance, DCO 1.1, trademark guidance, security policy, roadmap, porting guide, citation metadata, and GitHub community templates
• add read-only CI, DCO enforcement, Dependabot, and CODEOWNERS
• ship the project LICENSE, NOTICE, and third-party notice summary inside every assembled macOS app
• document the completed repository and Git-history publication audit

Verification

• swift test — 135 XCTest tests and 5 Quick Look Swift Testing tests passed
• python3 -m unittest discover -s site -p 'test_*.py' — 9 tests passed
• ./scripts/build-app.sh — app and Quick Look extension built Universal 2 (x86_64 + arm64)
• ad-hoc code signatures and bundled legal files verified
• shell syntax, plist, YAML, Markdown links, git diff --check, working-tree secret scan, and full-history git-secrets scan passed

Publication notes

The repository remains private until this PR is reviewed and merged. The new required CI contexts and CODEOWNERS file are introduced by this PR, so the existing PR-only founder bypass may be needed for this one bootstrap merge. Subsequent pull requests will receive the checks normally.

The audit found no credentials, signing material, subscriber data, or publication blocker. Residual low-risk findings are documented in docs/PUBLICATION_AUDIT.md.

[ashtree74]

Self-review completed with no blocking findings.

Checked:

• final scope contains only the open-source preparation work
• Apache-2.0, NOTICE, authorship, governance, DCO, and trademark language are internally consistent
• Astrography appears only as the current macOS signing/distribution entity, not as owner or governor
• assembled app packaging carries LICENSE, NOTICE, and third-party notices
• CI uses read-only permissions and a pinned checkout action
• working tree and all reachable Git history passed secret scans
• no generated app, database, subscriber export, signing material, or credential file is included

Residual low-risk findings remain explicitly recorded in docs/PUBLICATION_AUDIT.md: historical release binaries increase clone size, and the landing page retains third-party analytics JavaScript.

This is the bootstrap PR for its own CI and CODEOWNERS policy. The author cannot approve their own PR, so after required checks pass it will use the repository's PR-only founder bypass, preserving the PR and audit trail.