feat: polish OSS release experience

[JamesbbBriz]

Summary

• add a simpler SDK happy path, CLI subcommands, doctor diagnostics, shell completion, and release smoke scripts
• add OSS release infrastructure: GitHub Release artifacts, Maven Central signing flow, SBOM generation, Javadocs Pages workflow, dependency review, Dependabot, issue/PR templates, security/code-of-conduct docs
• add evidence/BBox docs, install/CLI/Homebrew/release docs, integration/use-case docs, and a public API snapshot gate

Verification

• mvn verify: 703 unit tests, 16 integration tests, 0 failures, 2 skipped, coverage gate passed
• mvn spotless:check
• mvn checkstyle:check
• YAML syntax check for GitHub workflows and Dependabot config
• scripts/compile-quickstart.sh with JDK 25 javac
• scripts/package-cli-release.sh --version 0.2.0-alpha --dist /tmp/doctruth-release-final-smoke
• scripts/smoke-cli-release.sh --version 0.2.0-alpha --dist /tmp/doctruth-release-final-smoke
• mvn -DskipTests cyclonedx:makeAggregateBom
• mvn javadoc:javadoc

Release notes

• Maven Central/GPG secrets are configured in GitHub Actions.
• HOMEBREW_TAP_TOKEN and live provider API keys are not currently configured, so Homebrew tap auto-push and nightly live LLM smoke need those secrets before they become fully active.
• This PR does not push a release tag.