[margani]

Closes #81.

Merged from the owner's project template and filled from the repo as it is.

• Kept from the template: the GitHub workflow (issue first, PR, merge when green), owner issues assigned and labelled needs-owner (the label now exists), and the rule against inventing UI steps for external services.
• Filled in: purpose, stack, and the real commands: ./run-tests, ./build-release, CI's parse check, and the disposable-machine harden test. There is no enforced linter, and the file says so rather than naming one.
• Added from the repo's standing rules: flags rather than env vars, secrets via file or stdin, destructive modes only against fakes or disposable machines, signed commits, no AI attribution, English only, ASCII PowerShell.
• Marked as not applicable, with what replaces them: Cloudflare Workers, wrangler, the sandbox/production branches, visual and PWA testing, and the database. There is no deployment; a release is a signed tag that the release workflow publishes.

Verified: ./build-release still ships only the scripts, ops-get, MANIFEST and SHA256SUMS (CLAUDE.md is not an asset), and ./run-tests reports all 10 passed, 3 skipped (Windows-only).