E9: Hardening, cross-build CI, perf, OSS prep

[ajianaz]

Epic E9 (docs/epics.md) — Phase 3

Acceptance criteria

• CI matrix builds aarch64-android + aarch64-apple-ios (build only)
• Tool timeout + output truncation tested; panic-free on bad input
• Benchmark: single turn mock < documented threshold; results in docs/perf.md
• Repo public-ready: LICENSE, README quickstart, SECURITY.md

Est ~16h. Depends: E8.

[ajianaz]

Progress on E9 (2026-09-18):

• ✅ Cross-build matrix: ci: cross-compile tole-core for the mobile targets (E9 partial) #82 adds a cross-compile job — cargo check -p tole-core --no-default-features for aarch64-apple-ios (macos-14) and aarch64-linux-android (ubuntu runner + preinstalled NDK, cc env pointed at the NDK clang for bundled sqlite). Both invocations verified locally before landing.
• ✅ Repo public-ready pieces: README rewritten for v0.3.0 reality (quickstart, tool table, risk model, ecosystem position) + AGENTS.md added (docs: README refresh + AGENTS.md + epics status sync #79, merged). docs/epics.md synced — Track A/B were already implemented but listed as planned.
• ⏳ Still open from this epic: perf benchmark + docs/perf.md threshold, timeout/truncation fuzz-lite hardening, and the Android build (link step) once an actual mobile embedder exists — the compile-check lands first.