Harden imports and release tooling

[conching]

Summary

• fail closed on ambiguous import signatures and attachment matches
• restrict KSES input controls to the intended radio/checkbox contract
• improve importer accounting, key handling, spreadsheet-safe export, and workbook memory use
• add dependency metadata, CI, security policy, checksummed release builds, and regression tests

Verification

• all PHP and Python syntax checks passed
• 32 PHP helper assertions passed
• 5 KSES assertions passed
• 29 Python unit tests passed
• 15 workbook end-to-end checks passed
• production ZIP built, checksum verified, and archive integrity checked

Release note

This prepares LC Core 0.3.0. The generated ZIP and checksum remain ignored build artifacts and are not committed.

---

Recreated from #1, which GitHub auto-closed when master history was rewritten to correct commit authorship on the initial release. No code changed — the tree is byte-identical.