fix(packaging): ship runtime data only

[pacharanero]

TL;DR: The python package does not need to ship the entire contents of the source repo.

Summary

• remove the unlicensed Fenton source publication from the current repository tree
• replace broad package-data globs with an explicit 15-resource runtime allowlist and exclude the test package
• enforce exact wheel and source-distribution contents in tests and release CI
• build local candidate wheels from a clean temporary worktree copy so stale build metadata cannot affect artifacts
• record the licensed-reference-data invariant in AGENTS.md and update the maintenance roadmap

Why

Published wheels included provenance and test material that runtime consumers do not need, including GrowthchartLMSmethod07.pdf. The PDF states that it is copyrighted with all rights reserved, and no licence permitting repository or PyPI redistribution has been identified. Public availability is not redistribution permission.

This change removes the file prospectively without rewriting Git history or yanking historical releases.

Artifact result

• wheel: 48 files, containing only Python modules and the 15 approved runtime JSON resources
• source distribution: 53 files, approximately 380 KB, with an exact non-Python allowlist
• installed-wheel smoke exercises every packaged data family

Validation

• s/lint --running
• s/test --running -q -rs - 145,280 passed
• s/test-wheel
• focused distribution policy tests - 13 passed
• real wheel and sdist manifest checks
• git diff --check