[evanpaul90]

Outcome

Turns CineTrace 0.3.0 into an inspectable source release without claiming npm publication.

• replaces the broken public npx cinetrace path with a tagged-source Quick Start
• adds a real five-frame production filmstrip and GitHub Pages evidence site
• publishes complete sanitized baseline/control reports with checked SHA-256 provenance
• adds CI-bound evidence verification and a public-surface regression test
• adds proportionate contribution, security, conduct and issue/PR guidance
• keeps the distributable package payload product-agnostic and unchanged at ten files

Verification

• npm test: 31/31 pass across Chromium, Firefox and WebKit
• npm run evidence:verify: four digests, two schemas and matching fingerprints pass
• npm audit --audit-level=moderate: zero vulnerabilities
• npm pack --dry-run: 10 files, 20.9 kB packed
• staged Pages site: desktop/mobile 200, one H1, five frames, zero overflow, all local evidence links 200, zero page/console errors
• secret/private-path scan: clean

Evidence boundary

The hosted gallery is an editorial sample of unaltered production frames. The raw JSON and release bundle remain the authoritative sampled evidence. Phone-sized desktop contexts are not physical-device tests, and the automated checks are not WCAG certification. No npm package is published by this PR.