feat: harden Autopilot demo quality gates

[rergards]

Summary

• Add scripts/public_safety_scan.py --tracked --staged and wire it into /verify plus CI.
• Move committed scorecard freshness into quality_scorecard.py --check and keep suppression scanning tokenize-aware in the live gate.
• Ratchet Ruff global ignores from 33 to 3 while keeping old package/test debt scoped.
• Add a strict Pyright slice for version.py, mcp_tool_profiles.py, and disk_budget.py.
• Remove tracked .verify-state, document the public-safe workflow review protocol, and update the scorecard/backlog.

Verification

• ruff check mempalace_code/ tests/ scripts/
• ruff format --check mempalace_code/ tests/ scripts/
• python -m pyright --pythonpath "$(python -c 'import sys; print(sys.executable)')"\n- python -m pyright -p pyrightconfig.strict.json\n- python scripts/public_safety_scan.py --tracked --staged\n- python scripts/quality_scorecard.py --check\n- python -m pytest tests/ -x -q -m "not needs_network" -> 2349 passed, 2 deselected\n- backlog validate --file docs/BACKLOG.yaml\n- git diff --check\n- actionlint .github/workflows/ci.yml