Docs: add retro docs website, security policy, and automated hall-of-fame workflows

.github/ISSUE_TEMPLATE/security_report.yml

@@ -0,0 +1,36 @@
+name: Security Report (Public Placeholder)
+description: Use this only if private advisory reporting is unavailable.
+title: "[Security]: "
+labels: ["security"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For sensitive vulnerabilities, please use GitHub Security Advisories for private disclosure.
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: Short description of the issue.
+      placeholder: Describe the vulnerability.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Reproduction Steps
+      description: Exact steps to reproduce.
+      placeholder: 1. Do this... 2. Do that...
+    validations:
+      required: true
+
+  - type: textarea
+    id: impact
+    attributes:
+      label: Impact
+      description: What can an attacker do?
+      placeholder: Impact details.
+    validations:
+      required: true

.github/workflows/deploy-website.yml

@@ -0,0 +1,41 @@
+name: Deploy Docs Website
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "website/**"
+      - ".github/workflows/deploy-website.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup Pages
+        uses: actions/configure-pages@v5
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v4
+        with:
+          path: "website"
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/publish-pypi-auto.yml

@@ -0,0 +1,36 @@
+name: Publish PyPI (Auto)
+
+on:
+  push:
+    tags:
+      - "v*"
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install build tooling
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build twine
+
+      - name: Build package
+        run: python -m build
+
+      - name: Publish to PyPI
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        run: |
+          python -m twine upload dist/* --skip-existing --verbose

.github/workflows/update-hall-of-fame.yml

@@ -0,0 +1,60 @@
+name: Update Hall of Fame
+
+on:
+  push:
+    branches: ["main"]
+    paths-ignore:
+      - "website/data/contributors.json"
+  schedule:
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  update-contributors:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Build contributor data from GitHub API
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const perPage = 100;
+            const contributors = await github.paginate(
+              github.rest.repos.listContributors,
+              { owner, repo, per_page: perPage }
+            );
+
+            const mapped = contributors
+              .filter(c => c.type === 'User')
+              .map(c => ({
+                login: c.login,
+                profile: c.html_url,
+                contributions: c.contributions
+              }))
+              .sort((a, b) => b.contributions - a.contributions);
+
+            const fs = require('fs');
+            fs.writeFileSync(
+              'website/data/contributors.json',
+              JSON.stringify(mapped, null, 2) + '\n'
+            );
+
+      - name: Commit updates
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          if git diff --quiet; then
+            echo "No contributor changes"
+          else
+            git add website/data/contributors.json
+            git commit -m "chore: update hall of fame contributors"
+            git push
+          fi