docs: record Public Preview readiness

[tensornull]

Summary

• record Public Preview as complete in AGENTS.md and ROADMAP.md
• preserve the repository, security, environment, public CI, and protected live-smoke evidence
• move the release checklist boundary to the separately authorized Registry Alpha gate
• keep the GitHub pypi environment reviewer as remote configuration rather than hard-coding an account in repository documentation

Impact

This is documentation-only. It adds no SDK API, source, dependency, or workflow change and creates no tag, release, Trusted Publisher, or PyPI publication.

Evidence

• public default-branch CI: https://github.com/cometapi-dev/cometapi-python/actions/runs/30248141487
• protected live smoke: https://github.com/cometapi-dev/cometapi-python/actions/runs/30248383703
• remote rulesets, Private Vulnerability Reporting, immutable releases, and environment protections were re-audited before this PR
• LIVE_SMOKE_ENABLED=false; Release Please remains disabled through the initial manual alpha
• no tag or GitHub release exists

Local validation

The full documented local gate passed with these readiness-document changes present:

• uv sync --locked
• uv run ruff check src tests scripts
• uv run ruff format --check src tests scripts
• uv run pyright
• uv run pytest -m "not live" (200 passed, 1 live deselected)
• version, public-content, secret, workflow, artifact, clean-install, repository-independence, and actionlint gates
• exact wheel SHA256: a4382ddaa8105507afe2d4253caf1e61af8d79707a0bd29b95f845cc3bc1841c
• exact sdist SHA256: 36e8ad4313dcdee0d29b4ba044add211cd6016655b5bb336e2f9c2b661b46560

After the final wording adjustment, uv run python scripts/check_version.py --require-public-preview-docs, uv run pytest tests/test_release_documents.py (12 passed), and git diff --check passed.

[tensornull]

Public Preview closeout is complete.

Merge and CI

• Squash merge commit: a53ddf98a4641dde6f2899e84b5b373bd9c410b6
• PR-head CI: https://github.com/cometapi-dev/cometapi-python/actions/runs/30249144002 — all nine required checks passed for 8219dfa7b81c71faff2edbe0990aaa78b3211a86; the latest-within-major canary was skipped by its reviewed event policy.
• Final main CI: https://github.com/cometapi-dev/cometapi-python/actions/runs/30249352995 — all nine blocking jobs passed for the merge commit.
• Public scheduled baseline CI: https://github.com/cometapi-dev/cometapi-python/actions/runs/30248141487 — passed.
• Authorized protected live smoke: https://github.com/cometapi-dev/cometapi-python/actions/runs/30248383703 — passed the four-request budget against gpt-5.4.

Remote state re-audit

• The canonical repository is public.
• Active main ruleset 19800141 requires pull requests and nine CI contexts with zero approvals, permits only squash merges on main, blocks deletion and force pushes, and reserves OrganizationAdmin bypass for emergencies.
• Active refs/tags/v* ruleset 19800170 blocks tag updates and deletion.
• Private Vulnerability Reporting and immutable releases are enabled.
• live-smoke has no required reviewer. pypi requires the current maintainer account tensornull and permits self-review. This reviewer identity exists only in the GitHub environment configuration; it is not hard-coded in repository files or CODEOWNERS.
• COMETAPI_KEY remains an environment secret and LIVE_SMOKE_ENABLED=false.
• Release Please remains fail-closed because RELEASE_PLEASE_ENABLED is not set to true.

Release boundary

• No Git tag or GitHub release exists.
• The official PyPI JSON endpoint for cometapi returned HTTP 404 at closeout.
• No Trusted Publisher, PyPI publication, provenance, or public-registry installation was configured or claimed.
• Registry Alpha remains separately authorized work.

Final local state

The worktree is clean and checked out on dev. HEAD, local main, local dev, and origin/main all resolve to a53ddf98a4641dde6f2899e84b5b373bd9c410b6.