chore: prepare repository for Gitea publication

ROADMAP.md

@@ -18,13 +18,13 @@ Workstation, geo pipeline, and engine validation are done. The art pipeline has
 
 **Next up:** model the hero façade and block frontage from the reference set, then first-person traversal on the site terrain. **Release gate:** `v0.1.0` is tagged only on the owner's explicit go-ahead once the release checks pass — not automatically when the checkboxes close.
 
-**Open decisions:** code licence (MIT proposed); whether shipped builds carry a derived OSM database (ODbL posture).
+**Open decision:** whether shipped builds carry a derived OSM database (ODbL posture).
 
 ## 0.1.0 — Local setup and walkable Hollywood block (weeks 1–6)
 
 ### Environment setup
 
-Status detail in [Docs/setup.md](Docs/setup.md); workstation audit in [Docs/environment.md](Docs/environment.md); pins in [Docs/toolchain.md](Docs/toolchain.md).
+Status detail in [Docs/setup.md](Docs/setup.md); pins in [Docs/toolchain.md](Docs/toolchain.md). The workstation audit is local only.
 
 - [x] Update Bazzite using its supported mechanism; verify NVIDIA driver and Vulkan operation.
 - [x] Register an Epic account and accept the Unreal license; obtain a pinned Linux engine build or build from Epic's authorized source repository.
@@ -71,6 +71,16 @@ Status detail in [Docs/setup.md](Docs/setup.md); workstation audit in [Docs/envi
 - [ ] Fixed daytime lighting and basic ambience.
 - [ ] Geographic attribution display ("© OpenStreetMap contributors" + license link).
 
+### Repository publication - active - 42a29fe2-651a-4483-be7f-6d9040c53053
+
+- [x] Remove confirmed private documents and bundled skills from publishable history while preserving local copies; validate all refs and LFS objects. Rewritten 2026-11-07; original history is in a separate private local backup.
+- [x] Scan all reachable Git history with Gitleaks 8.28.0. Removed an Android File Server security token from history and disabled the unused server; the rescan found no leaks.
+- [x] Review Unreal asset provenance via the generation/import scripts and inspect all 18 reachable Unreal asset versions for recognizable private-reference paths. No such paths were found; this is not a full binary-content audit.
+- [x] Review OSM source distribution notices: original data retains attribution and licence metadata, and the repository links directly to ODbL 1.0.
+- [ ] Review ODbL obligations for each shipped derivative database or produced work before public release.
+- [-] Validate Gitea LFS upload support during the first authorized push. `origin` was reachable on 2026-11-07 and advertised no refs; LFS upload remains untested.
+- [-] Commit and review the publication preparation changes before pushing.
+
 ### Release checks
 
 - [ ] Player can traverse both sides of the demo without falling through geometry. Blender pre-check passes: 0 raycast holes along both sidewalks and the designated crossing; worst seam step 15.8 cm at the sidewalk's outer edge (`Art/blender/README.md`). Engine traversal still to be tested.