Standardize public metadata, release qualification, docs, and sidecar #50

Objective

Bring ml4t-data, its public repository settings, release process, deployed documentation, and
private development sidecar into compliance with the current ML4T ecosystem standards.

Confirmed starting deviations

• PyPI 0.1.3 publishes a generic team identity, incomplete keywords and project URLs, and a stale
  README description of the ecosystem.
• Source metadata does not use the canonical author and maintainer identities, description,
  keywords, or project URLs.
• The README lacks the complete link and development-gate contract and contains stale or
  unsupported claims.
• The release repository does not contain the required one-line CLAUDE.md import and its root and
  nested agent instructions contain detailed, volatile repository and API inventories.
• CI lacks part of the common pull-request gate and the release workflow does not yet implement the
  complete commit-bound artifact-manifest and documentation-publication sequence.
• Deployed documentation lacks ml4t-library, ml4t-version, and ml4t-commit metadata.
• Main-branch protection and repository security settings do not yet satisfy the complete shared
  intake and release contract.
• The private ml4t-data-dev sidecar has no origin and has existing untracked content that must be
  classified and preserved while adding the required sidecar topology.

Acceptance criteria

• Source, built wheel, GitHub settings, deployed documentation, and the next authorized PyPI
  release agree on the canonical metadata.
• QLDM_DATA_ROOT and QldmError remain compatibility aliases with tested runtime deprecation
  warnings and documented replacements.
• README installation and quick-start behavior pass from a clean wheel install and all links
  resolve.
• Pull requests and releases run the required lint, format, type, test, build, security,
  documentation, and ecosystem qualification gates without weakening provider-specific checks.
• Release artifacts are built once, bound to the candidate commit by a digest manifest, published
  through trusted publishing only after documentation deployment succeeds, and verified after
  publication.
• The sidecar satisfies the private repository topology without losing existing work.
• The full repository quality suite, strict documentation build, package checks, workflow/security
  validation, and ecosystem qualification pass.

Tracked by ml4t/ecosystem#13.