[refactor] isolate protocol source from site hosting

[sierracatalina]

summary

• make the repository root protocol-first
• move the specification, schemas, fixtures, and reference runtime under protocol/
• remove the personal-site renderer and hosting stack

changed areas

• protocol/, packages/, tests/, docs/, release and security documentation
• removed app/, build/, worker/, public/, and framework hosting configuration

database/schema impact

• no schema semantics changed; public schema file paths move to protocol/schemas/

testing performed

• npm test: 78/78 passed
• npm run lint
• npm run release:hygiene
• npm audit --audit-level=high: 0 vulnerabilities
• git diff --check

risks and follow-up

• consumers using old public/ paths must update to protocol/ paths
• the existing v0.2-draft tag remains an immutable historical snapshot
• rollback: revert commit 18e171f