Tighten the AUM public trust boundary

[minglong51]

What changed

• replace the long README with a concise, evidence-first front door and operator reference
• add changelog, security, contribution, and privacy-aware issue paths
• remove maintainer operational config and identifying captures from the current tree
• harden release verification and package metadata

Verification

• 75 existing tests passed
• design-doc drift and coverage checks passed
• wheel and sdist built and passed twine check
• built artifacts contain only the sanitized default config
• dashboard capture passed browser, console, network, and privacy checks

Historical commits are intentionally unchanged; they contain non-secret metadata, and rewriting public history is outside this scoped pass.