Rebuild the HyperFlux Next repository experience

[offalexjackson777-stack]

Overview

Rebuild the HyperFlux Next repository experience around one canonical route and metadata registry, one public-readiness projection, and a generated, evidence-bound documentation portal.

This change also:

• absorbs the public roadmap-link correction from Fix public roadmap links #8 exactly once;
• fixes CodeQL alert build(deps): bump serde_json from 1.0.150 to 1.0.151 in the rust-dependencies group #1 with a bounded Mermaid edge parser and regression coverage;
• adds a versioned local companion snapshot contract with explicit privacy and write-safety boundaries;
• makes development workspace guidance portable across checkouts;
• completes SPDX licensing authorities and generated legal documentation;
• aligns solo-maintainer governance with strict required checks and linear history;
• derives protected-main check contexts from the generated workflow job names so governance cannot silently drift after a workflow rename;
• adds focused portal, metadata, readiness, governance, repository-experience, and hosted-runner verification.

Why

The previous repository surface duplicated navigation and readiness claims across README, generated pages, and hand-maintained route logic. That made links, metadata, licensing, and CI policy easier to drift. The new structure generates public projections from canonical authorities and verifies freshness, fragments, metadata, privacy boundaries, package reproducibility, and performance budgets.

Verification timing authorities were also corrected from stale values to measured concurrent-lane budgets. The Python suite now has a reviewed 60-second expectation and 120-second hard ceiling; OpenRGB retains its measured 300-second contract.

Hosted-run corrections

The first hosted full-lane attempt exposed a runner-identity portability defect. GitHub's rootless container ran as numeric UID 1001, while the pinned image named UID 1000. Setting USER and LOGNAME did not solve it because dbus-run-session resolves the numeric identity through NSS before starting the private bus.

The current head:

• probes the pinned image's Unix account databases through bounded, networkless, capability-free reads;
• projects only the canonical hyperflux account onto the host UID/GID;
• preserves every other image account and rejects numeric collisions;
• rejects inline credential material and emits only non-secret shadow markers;
• mounts temporary mode-0444 account projections read-only;
• never copies the host username, grants root, adds capabilities, enables networking, or weakens hardware isolation;
• binds every pull-request checkout and evidence summary to the exact pull-request head SHA rather than GitHub's synthetic merge revision.

An actual arbitrary 1001:121 container probe successfully opened a private D-Bus session, and the complete OpenRazer compatibility lane passes under the projected identity.

The protected-main plan previously used display labels such as Verification / Fast software, while GitHub reports the actual required status context as Fast software. The current head binds the ruleset to the eight generated job contexts and verifies that every configured requirement maps to a real workflow job.

Verification

Exact candidate head: d12fa1bc1c11d50d834f985b9b5cc09bd946d263

Canonical clean-tree full lane:

• command: ./hfx ci verify --image hyperflux-next-dev:ci --lane full --output build/ci/local-full-clean-d12fa1b
• result: PASS
• evidence run: hfxv-ba2450ce1c5c8e0b392d
• duration: 509.507 seconds
• nodes: 30/30 passed
• claims: 51/51 passed
• Python tests: 222 passed, 1 expected skip
• OpenRGB contract: 23/23 passed
• OpenRGB thread-sanitizer contract: 23/23 passed
• Polychromatic contract: 16/16 passed
• OpenRazer compatibility contract: 10/10 passed
• reproducible package contract: passed
• generation ran twice and remained current

Safety evidence:

• hardware.queried=false
• hardware.writes_executed=false
• publication_authorized=false
• no release, tag, package publication, or hardware-writing workflow is introduced

Hosted gates

• All eight exact-head required GitHub checks are green
• Pull-request CodeQL alert count is zero
• Generated Pages preview is verified
• GitHub governance and repository metadata are reconciled from reviewed authorities

Every current-head hosted gate is green. Pages publication remains a separate post-merge operation and is not authorized by this pull request.