docs/config/packages: add v0.1 release prep, security status, and SDK enhancements

- Add Stage 23 roadmap for v0.1 release preparation with PyPI/npm publishing, deployment automation, and security audit milestones
- Document competitive differentiators: zkML/FHE integration, hybrid TEE/ZK verification, on-chain model marketplace, and geo-low-latency matching
- Update security documentation with smart contract audit results (0 vulnerabilities, 35 OpenZeppelin warnings)
- Add security-first setup

.github/workflows/publish-npm-packages.yml

@@ -0,0 +1,69 @@
+name: Publish NPM Packages
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      package:
+        description: 'Package to publish (aitbc-sdk or all)'
+        required: true
+        default: 'aitbc-sdk'
+      dry_run:
+        description: 'Dry run (build only, no publish)'
+        required: false
+        default: false
+        type: boolean
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+        registry-url: 'https://registry.npmjs.org'
+
+    - name: Install dependencies
+      run: |
+        cd packages/js/aitbc-sdk
+        npm ci
+
+    - name: Run tests
+      run: |
+        cd packages/js/aitbc-sdk
+        npm test
+
+    - name: Build package
+      run: |
+        cd packages/js/aitbc-sdk
+        npm run build
+
+    - name: Check package
+      run: |
+        cd packages/js/aitbc-sdk
+        npm pack --dry-run
+
+    - name: Publish to NPM
+      if: ${{ github.event.inputs.dry_run != 'true' }}
+      run: |
+        cd packages/js/aitbc-sdk
+        npm publish --access public --provenance
+
+    - name: Dry run - check only
+      if: ${{ github.event.inputs.dry_run == 'true' }}
+      run: |
+        cd packages/js/aitbc-sdk
+        echo "Dry run complete - package built and checked but not published"
+        npm pack --dry-run

.github/workflows/publish-python-packages.yml

@@ -0,0 +1,73 @@
+name: Publish Python Packages
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      package:
+        description: 'Package to publish (aitbc-sdk, aitbc-crypto, or all)'
+        required: true
+        default: 'all'
+      dry_run:
+        description: 'Dry run (build only, no publish)'
+        required: false
+        default: false
+        type: boolean
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.11'
+
+    - name: Install build dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install build twine
+
+    - name: Build aitbc-crypto
+      if: ${{ github.event.inputs.package == 'all' || github.event.inputs.package == 'aitbc-crypto' }}
+      run: |
+        cd packages/py/aitbc-crypto
+        python -m build
+
+    - name: Build aitbc-sdk
+      if: ${{ github.event.inputs.package == 'all' || github.event.inputs.package == 'aitbc-sdk' }}
+      run: |
+        cd packages/py/aitbc-sdk
+        python -m build
+
+    - name: Check packages
+      run: |
+        for dist in packages/py/*/dist/*; do
+          echo "Checking $dist"
+          python -m twine check "$dist"
+        done
+
+    - name: Publish to PyPI
+      if: ${{ github.event.inputs.dry_run != 'true' }}
+      run: |
+        for dist in packages/py/*/dist/*; do
+          echo "Publishing $dist"
+          python -m twine upload --skip-existing "$dist" || true
+        done
+
+    - name: Dry run - check only
+      if: ${{ github.event.inputs.dry_run == 'true' }}
+      run: |
+        echo "Dry run complete - packages built and checked but not published"
+        ls -la packages/py/*/dist/