Measure the agent's real overhead, and write the policy Central needs

[lsmin3388]

What changed

Post-0.2.0 hardening in three areas: an overhead measurement that can be
quoted, the policy work Maven Central publication depends on, and the project
files an outside contributor looks for.

Overhead is now measurable, and measured

The 2026-08-10 capture ran the baseline once, then the agent once, and reported
the agent as faster than the baseline. That is the shape a single-order run
produces when drift points the same way. It is retired rather than
reinterpreted.

capture-performance-evidence.sh now measures both modes over several rounds,
restarting each JVM every round and flipping which mode runs first, and reports
the median of the per-round paired differences.

That alone was not enough: the demo endpoint enters four instrumented methods,
too few to separate from noise. /auto/depth/{n} in the MVC sample walks a
chosen number of instrumented method entries, so the cost can be measured as a
slope rather than at one point.

Endpoint	Instrumented entries	Median Δ p50	Rounds the agent was slower
/auto/orders/1	~4	−0.038 ms	2 / 6
/auto/depth/0	~5	+0.010 ms	4 / 6
/auto/depth/1000	~1005	+0.059 ms	6 / 6
/auto/depth/5000	~5005	+0.138 ms	6 / 6

≈24 ns per instrumented method entry (≈50 ns cold, ≈20 ns warm), with the
fixed per-request cost inside the noise floor. The "rounds slower" column is
the honesty check — at four entries the agent lands on either side of the
baseline, so the −0.038 ms is noise and not a speed-up.
docs/15_performance_results.md lists what this
does not cover: concurrency, GC and allocation, startup cost.

A report from a newer schema is refused instead of misparsed

Found while writing the compatibility policy. The writer has always stamped
schemaVersion, but CoverageReportJson.read ignored it, so a future v2
document fed to a v1 build would parse into a silently wrong result. A report is
written by one CI job and read by another, and the two do not upgrade at the
same moment.

A document with no schemaVersion still reads as version 1 — that is the
only shape that has ever existed, and rejecting it would only break hand-written
documents.

Policy and project files

• docs/20_versioning_and_compatibility.md —
  what a version promises, what counts as public API, how the report schema
  evolves, and what happens when a release is broken. Central is permanent, so
  this had to exist before the first upload. Doubles as the acceptance
  criteria for Automate signed Maven publication for the reusable library modules #4.
• docs/19_prior_art.md — where Reqover sits next to
  OpenClover, the commercial test-impact products, APM tracing, and traffic
  replay, including the cases where one of those is the better answer.
• GOVERNANCE.md, ROADMAP.md,
  SUPPORT.md, CITATION.cff.
• GitHub Discussions enabled; the issue chooser now points questions at Q&A
  instead of collecting them as bug reports.

Korean versions of docs 15, 19, and 20 are included.

Checklist

• ./gradlew test passes — 125 tests, 0 failures
• ./gradlew build passes
• New behavior is documented (README or docs/)
• License or dependency changes are reflected in THIRD_PARTY_NOTICES.md — no dependency changes
• No secrets, tokens, or .env files included