Harden imports and release tooling

[conching]

Summary

• fail closed on ambiguous import signatures and attachment matches
• restrict KSES input controls to the intended radio/checkbox contract
• improve importer accounting, key handling, spreadsheet-safe export, and workbook memory use
• add dependency metadata, CI, security policy, checksummed release builds, and regression tests

Verification

• all PHP and Python syntax checks passed
• 32 PHP helper assertions passed
• 5 KSES assertions passed
• 29 Python unit tests passed
• 15 workbook end-to-end checks passed
• production ZIP built, checksum verified, and archive integrity checked

Release note

This prepares LC Core 0.3.0. The generated ZIP and checksum remain ignored build artifacts and are not committed.