feat: establish Mill foundation

[davidahmann]

Outcome

Establishes Mill as an independently installable, local-first TypeScript CLI with explicit contracts, hostile-safe static inspection, and a qualified OSS delivery foundation.

What changed

• Adds the product, architecture, workflow, development, governance, and Wave 1 task contracts.
• Implements millctl doctor, inspect, adopt --scan-only, and validate-contract with stable human/JSON behavior.
• Enforces exact Mill versions, canonical contract digests, Git-root authority, bounded safe reads, and fail-closed repository scanning.
• Adds pinned CI, CodeQL, dependency review, trusted-publishing release scaffolding, DCO, and OSS policy files.
• Packages the public CLI and JSON schemas with an installed-consumer smoke test.

Acceptance and evidence

• Exact candidate: 1458c19a37ba7940dc3a52103d6b4efb7cae37ab.
• Node 24.20.0 full gate: pass.
• Tests: 10 files / 45 tests pass.
• Coverage: 90.06% statements, 81.23% branches, 97.10% functions, 89.90% lines.
• Packed-package clean-install/import/CLI smoke: pass.
• Real linked-worktree adoption canary: pass.
• DCO: all six branch commits pass.
• Local Codex review: four systemic repair waves plus a final exact-delta review; the final P1 Git-root-depth bypass is fixed with an adversarial regression.

Risk and boundaries

This wave is intentionally static and non-executing. It does not build product code, mutate downstream repositories, access forge credentials, push branches, open PRs, merge, deploy, or claim hostile-code containment. Those capabilities require later qualified waves.

Assistance disclosure

Implemented with Codex assistance under the repository workflow; deterministic gates and local review evidence are reported above.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.