chore: prepare SDK for open source

[JJasonSun]

Summary

• add the MIT license with Copyright (c) 2026 CALL-E, Inc. and include it in the wheel and source distribution
• assign Si40Code and Ray-56 as code owners
• expand the README, security guidance, contribution guide, release guide, and changelog for a public SDK repository
• reject private-context links, raw HTTP IP URLs, and unconfirmed repository references in tracked files and pull request metadata
• make merges CI-only: stable PyPI publishing now requires a matching versioned GitHub Release, an approved environment, OIDC, and the validated wheel/source artifacts

Validation

• full validation on Python 3.12.14
• 42 tests passed; OpenAPI verification, Ruff, mypy, build, Twine, wheel install, and source-distribution install passed
• wheel and source metadata declare License-Expression: MIT; both artifacts contain the exact approved LICENSE
• all workflows passed actionlint; the staged tree and full Git history passed secret scanning

Administrator checklist before merge and public visibility

• Confirm CALL-E owns the code and decide whether the MIT grant also applies to already published 0.6.0 and 0.7.0
• Protect main: require pull requests, code-owner review, required CI checks, resolved conversations, and block force-push/delete without bypass
• Configure the pypi environment with Si40Code and Ray-56 as required reviewers, prevent self-review, disable admin bypass, and restrict deployments to protected v* tags
• Configure PyPI Trusted Publishing for this repository and workflow; remove the long-lived publish credential after OIDC is verified
• Review or sanitize historical personal author email and raw-IP references before making the repository public
• Replace the repository homepage metadata with https://docs.heycall-e.com/#/sdks
• Ask GitHub Support to remove the original pull-request description revision that contains a private repository link; GitHub does not expose a delete action for the original revision
• Enable private vulnerability reporting, secret scanning, and push protection
• Align the public SDK documentation with the supported package version

No package was published, no release was created, and repository visibility was not changed.