feat: launch Brief2Ship v0.6.2 discovery surfaces

[five0nit]

Problem and scope

Brief2Ship had strong runtime/release evidence but weak discovery and conversion surfaces: broad positioning, late quickstart, no PyPI/Agent Skills distribution path, generated social card, empty community surfaces, and no portable plugin metadata.

This PR packages the conversion and distribution work as v0.6.2 without adding a core runtime dependency or weakening discovery/scraping safety.

What changed

• conversion-first README, real dogfood GIF, custom social preview, comparisons, and case studies;
• PyPI Trusted Publishing workflow with exact release-asset verification and isolated OIDC permissions;
• GitHub Agent Skills, skills.sh, Hermes, and Claude Code plugin distribution metadata;
• Code of Conduct, roadmap, issue forms, PR template, and Discussions routes;
• v0.6.2 metadata, version surfaces, changelog, release receipt, and release-contract tests.

Verification

Python 3.11: 145 tests passed
Python 3.12: 145 tests passed
Python 3.13: 145 tests passed
Extracted sdist / Python 3.13: 145 tests passed
Ruff 0.16.5: passed
Pyright: 0 errors, 0 warnings
Actionlint 1.7.12: passed
Twine check: wheel + sdist passed
Clean wheel install + installed local discovery: passed
GitHub CLI 2.100.0 skill dry-run: passed
Claude Code 2.1.201 plugin/marketplace validation: passed
skills.sh CLI local discovery: exactly one skill
Gitleaks: no leaks found
Social preview and README GIF visual QA: PASS
Live HTTPS positive control: passed
Hostname-mismatch negative control: blocked, exit 3

An independent blocker review found wildcard release-asset selection in an intermediate PyPI workflow. The final workflow derives exact filenames from VERSION, requires an exact two-file checksum manifest, runs Twine before final integrity verification, and uploads only those exact paths.

Reuse decision

• selective-reuse

Canonical-repository exception: reused the existing Brief2Ship package, Agent Skill layout, release validation, and CI. No alternative implementation base or new runtime dependency was needed.

Safety and maintainability

• No credentials, private repository names, private URLs, or personal data entered the diff
• No candidate code executes during normal discovery
• Tests cover new packaging, asset, community, plugin, and trusted-publishing contracts
• Documentation and release surfaces updated
• python scripts/validate-release.py passes
• git diff --check passes

Known gates after merge

• exact-main GitHub Actions run;
• immutable draft release with exact tested assets;
• PyPI pending-publisher browser setup before manual tagged workflow dispatch;
• GitHub social-preview upload and profile pin/bio are web-UI-only actions.