engine: restore reproducible package, tests, CI, and human-first controls

[altmanAI]

Objective

Resolve DP-001 by making the DailyPilot reference engine reproducibly importable, testable, executable, and accurately documented.

Closes #2.

Root causes corrected

The repository claimed an engine.core.* architecture, but implementation files and profiles were located at the root. Tests and CLI therefore referenced paths that did not exist in a clean checkout. The root selectors.py filename also risked shadowing Python's standard-library selectors module.

Changes

Executable architecture

• Establishes the engine Python package.
• Moves data models, scoring, and selection logic into engine.core.
• Moves example profiles into engine/profiles.
• Exposes a bounded public interface through engine.core.__init__.
• Removes superseded root modules and profile duplicates.

CLI reliability

• Routes imports through engine.core.
• Corrects profile resolution.
• Validates task arrays and profile objects.
• Parses ISO YYYY-MM-DD due dates.
• Writes normalized UTC timestamps.
• Aligns documented and actual CLI usage.

Evidence and CI

• Repairs all test imports and profile paths.
• Adds behavior coverage for importance, deadline proximity, score breakdowns, effort budgets, parked tasks, and profile integrity.
• Adds a least-privilege, shell-only GitHub Actions workflow with no external action dependencies.
• The workflow compiles sources, runs tests, and executes the documented CLI smoke test.

Public trust controls

• Adds repository-specific SECURITY.md.
• Adds .github/CODEOWNERS.
• Rewrites README, architecture, and API documentation with lifecycle status, capability boundaries, non-goals, human-control requirements, security expectations, and P.A.I.H.I. framing.
• Explicitly discloses that max_stress_load is not currently enforced.

Scope and compatibility

This is a package-layout correction for a reference implementation whose documentation and tests already claimed the engine.core import path. Root-level imports such as from models import Task are intentionally removed because they were not the documented architecture and created collision risk.

Security and privacy

• Workflow permissions are read-only.
• No production service, credential, external model, network integration, or private data source is added.
• The reference implementation remains local and standard-library-only at runtime.
• Public reporting guidance prohibits secrets and real private task data.

Validation

Independent reconstruction and execution completed successfully:

• Python compilation: passed
• python -m pytest -q: 6 passed
• python dailypilot_cli.py sample_day.json --profile worker_double_shift: passed and wrote a local run log

GitHub Actions runs 29259034440 and 29259157659 failed before any step executed and returned no job logs. This is tracked in #4 as a runner/account/policy infrastructure blocker rather than represented as a code failure.

Merge gate

Keep this PR open until hosted CI executes successfully or an attributable exception is approved and recorded. Rollback after merge would be a squash-commit revert.

AI assistance disclosure

• AI system: AltmanAI Model 2.0
• Assistance: Repository audit, defect analysis, package migration, code repair, test design, CI design, security policy, documentation, validation, and pull-request preparation
• Human authorization: Blake Hunter Altman issued ALL CLEAR FOR IMPACT on July 13, 2026
• Human accountability: Final merge and deployment decisions remain attributable to the authenticated repository owner

P.A.I.H.I.

• Proof: Direct inspection exposed broken imports and paths; six passing tests and a successful CLI run provide reproducible implementation evidence.
• Alignment: Restores an explainable human-support engine rather than adding autonomous authority.
• Integrity: Documents unsupported and unenforced behavior explicitly, including the hosted-runner blocker.
• Humanity: Preserves correction, override, privacy, accessibility review, and high-impact-use restrictions.
• Impact: Converts a public reference repository from concept-level credibility to an executable engineering baseline.

Decision class

Material engineering and governance change.

Authorization

All Clear for Impact: Approved