feat: harden GreenRisk packaging and reproducibility

[idcesares]

Summary

Hardens GreenRisk into an installable, testable, provenance-verifiable research package while preserving the frozen rulebase-locked-v1 numerical instrument.

What changed

• moves runtime code into an installable src/greenrisk package and adds the greenrisk CLI;
• adds strict finite [0,1] signal validation so scikit-fuzzy cannot silently clip invalid inputs;
• removes Hugging Face login/persistence side effects at import time;
• separates base, model, research, and development dependencies;
• pins the TCFD dataset revision/content hash and centralizes immutable model/instrument coordinates;
• records full input hashes and unrounded signal/trace values for new runs;
• repairs historical artifact hashes to Git-normalized LF bytes and expands manifests from immutable Git/Hugging Face history;
• adds per-score and run-level PROV-O integrity checks;
• adds pytest, Ruff, sdist/wheel build CI, SHA-pinned Actions, Dependabot, and a manual heavyweight model-smoke workflow;
• adds responsible-use, data, security, changelog, and updated repository-governance documentation;
• corrects over-broad evidence wording: the fuzzy decision layer is transparent but upstream classifiers are learned models; the contrast expectations and first results share one public commit, so the repository no longer claims independently timestamped blind preregistration.

Instrument boundary

No numerical instrument change or ablation:

• membership-function definitions: unchanged;
• rule antecedents and consequents: unchanged;
• model repositories/revisions: unchanged;
• signal-to-label mappings: unchanged.

A canonical numerical-payload hash test now guards all four coordinates.

Verification

• ruff check . — passed
• pytest -m "not model" — 13 passed, 2 heavyweight tests deselected
• locked fuzzy property suite — 4,158 grid points; trace/library discrepancy 0
• python scripts/verify_artifact_integrity.py — corpus and contrast artifacts verified
• python -m build --no-isolation — wheel and sdist built
• built CLI exercised at the known 88.33 anchor and rejected an out-of-range input
• Markdown links, YAML, JSON, compileall, uv lock --check, and git diff --check — passed

The model tests are intentionally available through the manually triggered workflow because they download and execute five large pinned checkpoints.

Release follow-up

After merge, mint the v0.2.0 release/tag and its version-specific Zenodo DOI; the citation file intentionally retains only the stable concept DOI until then.

[idcesares]

Remote verification is green: CI run #2 passed dependency sync, Ruff, the 13-test fast suite, artifact-integrity verification, and uv build. The first run correctly exposed that prov imports its XML serializer registry; follow-up commit b37b018 makes lxml an explicit runtime dependency and pins the Node 24-compatible setup action.