Repo cleanup for the 2.1.5 reviewer pass

[ShadowfetchLinux]

What this PR changes

A first-pass cleanup of the GitHub tree after Tammy Smith takes over the repo. Product behavior (Control Center, Buzz, Phoenix, Fireproof, first-run agents) is untouched.

• Docs and comments match 2.1.5 if they mention the current stable
• No ISO, torrent, .deb, GPG private key, Cloudflare token, or secret leaked in the diff
• make source-gate could not be run end-to-end here (this environment lacks shellcheck/gitleaks and a systemd user session). Targeted gates that did run passed: identity/artifact-route tests, desktop-file validation, parsers, Guide/Phoenix contracts, retired-runtime scan.

What I verified live (21 Aug 2026)

Path	Result
https://www.shadowfetch.com/linux/download/shadowfetch-2.1.5-amd64.iso	200, Content-Length: 3968471040
Matching .sha256 sidecar	200, hash 848f043e4d6f85c3607e7034ba911a1ce8b4a317674feebef8b07fcd8f531c24
https://www.shadowfetchlinux.org/download/shadowfetch-2.1.5-amd64.iso	404 — .org does not serve ISO bytes
Human pages (/download, /verify, /security)	Canonical on shadowfetchlinux.org; shadowfetch.com/linux/{page} 301s there
GPG key	Same 677-byte key on .com/linux/shadowfetch.gpg.asc, .org/shadowfetch.gpg.asc, and in-tree shadowfetch-release.asc
GitHub Discussions	404 (not enabled)
GitHub release v2.1.5	Notes already include checksum/fingerprint/URL; no assets (expected for a 4 GB ISO)
https://www.shadowfetchlinux.org/releases.json	Still reports latest = 2.1.4 (website repo, not this tree)
Claimed tarball …/apt/sources/shadowfetch-source-2.1.5.tar.gz	404; real corresponding source is APT main/source + this git repo

Changed

• Removed root leftovers: shadowfetch-2.1.4-amd64.iso.torrent (nothing linked it; .com 404s that torrent) and unused kimi-k3-abstract-hero.jpg.
• Canonical 2.1.5 notes stay in docs/RELEASE-2.1.5.md. Root RELEASE-2.1.5.md is now a short pointer.
• README curl block keeps freeze-host URLs (www.shadowfetch.com/linux/...) because those are the URLs that actually return the ISO. Docs/guides stay on www.shadowfetchlinux.org. Explains that GitHub Releases do not attach the ISO.
• SECURITY.md: private reports go to shadowfetchlinux@gmail.com (the address on the live site). Replaced the old Realbobcorbin/shadowfetch-linux issues URL.
• Issue templates already existed; pointed them at 2.1.5, stopped sending people to a 404 Discussions page, added CONTRIBUTING.md (make source-gate) and a PR template. No Code of Conduct invented.
• docs/GITHUB-RELEASE.md paste-ready notes; CI now writes checksum/verify URLs into future draft GitHub releases and still attaches only .sha256 / .asc.
• .gitignore: torrents, extra .deb leftovers, OpenPGP private-keyring paths.
• Worker: dead Realbobcorbin 2.1.1 torrent redirect now points at Archive.org. README/comments document that the Worker is the artifact proxy, not the public site.
• In-image SOURCES.md / LICENSES.md: written offer now matches the live licensing page (git + APT main/source + shadowfetchlinux@gmail.com), instead of the 404 tarball.
• Historical banner on ROADMAP-NEXT-BUILD.md; packages.manifest labeled as a 2.1.1 listing.

Left alone (and why)

• Product code, Umbra branding, LICENSE, TRADEMARKS.md, repo name/topics/homepage.
• Git history (no filter-branch / force-push / rewriting old commit emails).
• ISO binaries and the public signing key copies (SHA256SUMS, SHA256SUMS.asc, shadowfetch-release.asc).
• Worker HTML fallbacks that still mention Ollama on /linux/ pages: production 301s those routes to shadowfetchlinux.org. Rewriting ~1.5k lines of unserved copy would not change what reviewers see.
• weekly_release.sh (maintainer-local cron; no secrets in-tree).
• qa/2.1.4/ evidence and historical changelogs (provenance).
• Website releases.json still saying 2.1.4 — that feed is generated by the Astro site, not this repo.

Maintainer checklist (GitHub account, cannot be done from a PR)

These are User-account facts, not repo-file bugs:

1. Unsigned commits / personal email on old history. Recent commits are Bob Corbin <Robertcorbin84@gmail.com> and at least one 209457103+Realbobcorbin@users.noreply.github.com. Do not rewrite history to hide that. Optionally set user.email to the GitHub noreply address going forward, and enable commit signing (SSH or GPG) on new commits only.
2. User vs Organization. ShadowfetchLinux is a User (isInOrganization: false). Do not convert it. Call it a project account if reviewers ask.
3. Do not attach the 4 GB ISO to GitHub Releases. GitHub’s per-file limit is 2 GiB. Optional: attach only shadowfetch-2.1.5-amd64.iso.sha256 and .asc to v2.1.5, or paste docs/GITHUB-RELEASE.md.
4. Create labels needs-triage and hardware-report (templates reference them; GitHub may auto-create on first issue).
5. Private vulnerability reporting is unset. Email is the real path until you enable GitHub private reporting on this User repo (if available).
6. Discussions are off. Issue templates now send people to Issues. Only turn Discussions on if you want that channel.
7. Website repo (not this PR): https://www.shadowfetchlinux.org/releases.json still lists 2.1.4 as latest even though /download and /changelog already show 2.1.5. Fix that feed on the site so machines and humans agree.
8. Do not add fake stars, issues, or social proof.

How to test

Docs / GitHub-community files. After merge, open the repo front page and confirm: checksum + fingerprint in the README fold, no 2.1.4 torrent in the file list, Issues forms for Bug + Hardware, SECURITY policy email matches the site footer.