fix: use GHCR_PAT with GITHUB_TOKEN fallback for Docker

fix: clean dist/ before build to avoid stale versions

chore: ruff format after mypy fixes

fix: use GITHUB_TOKEN + dynamic tags for ghcr.io

chore: add release workflow, integration CI, docker-compose, fix mypy

Update publish workflow to include PyPI

chore: add dependabot.yml, .editorconfig, CODE_OF_CONDUCT.md

docs: add HF Spaces config, comparison table, homepage URL, cross-links to ecosystem

Add Nova-Rules patterns: malware keywords, policy puppetry, Claude triggers, scareware, weaponized code (10 categories total)