docs(#1): establish ISO/IEC 27001-aligned developer guide

[Cubewise-Ronan]

Summary

Replace the repository's fragmented notes with a production-oriented, mandatory English developer guide aligned with the software-development aspects of ISO/IEC 27001:2022 and Amendment 1:2024.

Closes #1.

Risk classification

• Standard
• High-risk — this PR adds a GitHub Actions workflow
• Emergency

Security and privacy

• The workflow runs only documentation pre-commit checks with contents: read.
• Pull-request code receives no repository or deployment secrets.
• The workflow has a 10-minute timeout and no write or deployment permission.
• Secret detection, private-key detection, YAML validation, and repository-local Markdown link validation are enforced.
• The guide explicitly avoids claiming that documentation alone establishes ISO/IEC 27001 conformity or certification.
• No customer, production, personal, credential, or incident data is included.

Scope

• Add a navigable guide entry point, governance, roles, risk classification, exception, and evidence requirements.
• Replace the unrelated student-oriented Python guide with production engineering standards.
• Standardize branch, commit, review, testing, release, rollback, vulnerability, secrets/data, supply-chain, AI/LLM, CI/CD, and extension-execution practices.
• Add an ISO/IEC 27001 clause and Annex A engineering-control mapping.
• Add a pull-request template, pre-commit checks, documentation workflow, and local link/anchor validator.
• Do not change product source code or runtime behavior.

Validation evidence

Check	Result
pre-commit run --all-files	Passed on a clean rerun
YAML validation	Passed
Private-key and secret detection	Passed
Repository-local Markdown links and anchors	Passed
python -m compileall -q scripts	Passed
git diff --cached --check	Passed before commit
Product test suite	Not applicable; this is a documentation-only repository

Release and operations

• No data migration or product deployment is required.
• Merge should require the documentation quality check and independent review.
• Rollback is a standard Git revert of commit d6cf1006aab71d7f43ac2b435679cb0f97b9751d.
• After the workflow reports its check context, protect main with required checks and independent approval.