feat(yaad): production hardening

[Patel230]

Summary

Production-hardening pass for yaad that brings the repo closer to top-50 OSS
repository standards. The branch contains two commits — a code-quality pass
and a re-baseline + OSS-hygiene + small-security-fix pass — both targeting
dev.

The mandate (per GOAL.md) is that yaad be the reference Go memory layer
for AI coding agents, comparable in quality to mem0 / MemGPT-Letta / Zep /
LangChain memory / kernel-memory, and built for solo developers who run
their coding agent locally.

Commits

1. feat(yaad): production hardening — strict linting, errcheck fixes, dead code removal
2. feat(yaad): re-baseline to v0.2.0 + OSS standards + untrack integrity.key

---

What's in commit 1 — code-quality pass

• .golangci.yml — strict v2 config: errcheck, staticcheck,
  gocritic (diagnostic + performance), unused, ineffassign,
  misspell, noctx, bodyclose, unconvert, whitespace.
• Unchecked error returns fixed across most production packages
  (engine/, storage/, ingest/, embeddings/, graph/, internal/...).
• Dead code removed flagged by the unused linter.

---

What's in commit 2 — version + OSS standards + small security fix

Version 0.2.0 across the repo

File	Change
internal/server/mcp.go	mcpserver.NewMCPServer("yaad", "0.2.0", ...)
sdk/python/pyproject.toml	version = "0.2.0"
sdk/typescript/package.json	"version": "0.2.0"
Formula/yaad.rb	version "0.2.0" + every release-asset URL
openapi.yaml	header version: "0.2.0" + /yaad/health example

The build-time injected internal/version.Version (defaults to "dev"
during local go run, overridden via -ldflags for release builds) is
unchanged — that's the right pattern; the hardcoded sites above are the
ones that matter for SBOM / homebrew / OpenAPI / SDK consumers.

Security: stop tracking .yaad/integrity.key

.yaad/integrity.key is a 32-byte HMAC key used for memory-integrity
verification. It was committed in 557662c ("feat: major retrieval
overhaul"). Committing it meant every clone shared the same key, which
defeats the purpose of the integrity check (anyone with the repo could
forge integrity-verified entries).

This PR:

• Untracks the file via git rm --cached .yaad/integrity.key (the
  local copy on contributors' disks is not deleted; yaad will keep
  using it).
• Adds .yaad/integrity.key to .gitignore so it cannot be re-added
  accidentally.
• Adds a checklist item in the PR template reminding contributors not
  to re-add it.

The yaad runtime is expected to regenerate the key on first run if
missing — please verify on a fresh clone before merge.

CHANGELOG.md

• Added ## [Unreleased] describing the re-baseline, the security fix,
  and the full hardening pass (both commits together).
• Existing 0.1.0 and earlier release notes preserved.

Cleanup of staged-but-uncommitted hardening from the prior commit

• internal/tls/tls.go: defer cf.Close() / defer kf.Close() →
  defer func() { _ = cf.Close() }() style for errcheck.
• internal/server/mcp.go: gofmt import sorting (third-party imports
  were not alphabetised by full path; github.com/GrayCodeAI/... sorts
  before github.com/mark3labs/...).

New OSS standard files

File	Purpose
.gitattributes	LF normalization, binary detection (incl. *.db), GitHub linguist hints (mark sdk/python/** as Python, sdk/typescript/** as TypeScript, large planning docs as documentation)
CODE_OF_CONDUCT.md	Contributor Covenant 2.1
.github/dependabot.yml	weekly gomod, pip (sdk/python), npm (sdk/typescript), github-actions; gomod grouped by modernc and mark3labs/mcp-go
.github/PULL_REQUEST_TEMPLATE.md	Summary / Changes / Memory-retrieval-quality impact / Schema-data-format impact / Testing / Checklist (with explicit "do not re-add integrity.key" item)
.github/ISSUE_TEMPLATE/bug_report.yml	structured bug report with surface dropdown (CLI / MCP / REST / Go SDK / Python SDK / TypeScript SDK / embedded library)
.github/ISSUE_TEMPLATE/feature_request.yml	feature request with a kind selector covering 12 functional areas (recall, ingestion, graph, decay/compaction, privacy, embeddings, storage, MCP, REST, CLI/TUI, SDKs, tooling)
.github/ISSUE_TEMPLATE/config.yml	routes security to advisories, questions to discussions, blocks blank issues

Expanded .gitignore

Also covers .yaad/*.db, .yaad/*.db-shm, .yaad/*.db-wal,
coverage.html, .gocache/, .gomodcache/.

---

Verification

Check	Status
go build ./...	✅ clean
go vet ./...	✅ clean
go test -race -count=1 -timeout=180s -short ./...	✅ pass on every package: dedup, embeddings, engine, exportimport, git, graph, hooks, ingest, intent, internal/daemon, internal/proactive, internal/search, internal/server, internal/temporal, mental, privacy, skill, storage, temporal, utils, root yaad, conflict, compact, browse, config
gofmt -l for files I touched	✅ clean

Test plan

• make build
• make test with -race
• go vet ./...
• gofmt -l for touched files is empty
• Verify on merge: a fresh clone of this branch boots cleanly,
  yaad regenerates .yaad/integrity.key on first run, and existing
  installations continue to work with their existing key.