chore: supply-chain metadata, npm publish workflow, and trim repo layout

Add GitHub security policy stub, OIDC-friendly publish workflow, publishConfig
and expanded npm keywords; point homepage at org docs. Remove duplicate nested
openFetch tree, docs site, demo app, and skill bundle from this repository
(keep single-package root layout).

Made-with: Cursor

Author: hamdymohamedak

.github/SECURITY.md

@@ -0,0 +1,12 @@
+# Security policy
+
+The full threat model, SSRF/cache/retry guidance, and local security checks live in [`SECURITY.md`](../SECURITY.md) at the repository root (also shipped on npm).
+
+## Reporting a vulnerability
+
+Please do **not** open a public issue for undisclosed security defects.
+
+- Prefer a [GitHub private security advisory](https://github.com/openfetch-js/OpenFetch/security/advisories/new) for this repository, or
+- Contact the maintainer privately if you cannot use GitHub advisories.
+
+Include enough detail to reproduce or reason about impact. We aim to acknowledge valid reports and coordinate disclosure after a fix is available.

.github/workflows/publish.yml

@@ -0,0 +1,34 @@
+# Publishes to npm using trusted publishing (OIDC). On npmjs.com, trusted publisher must
+# reference this repo: https://github.com/openfetch-js/OpenFetch and workflow file: publish.yml
+# Requires: npm CLI >= 11.5.1, Node >= 22.14 (see https://docs.npmjs.com/trusted-publishers )
+name: Publish to npm
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@^11.5.1
+
+      - run: npm ci
+      - run: npm test
+
+      # No NODE_AUTH_TOKEN: authentication is OIDC when trusted publishing is enabled.
+      # Provenance is generated automatically for trusted publishing from GitHub Actions.
+      - run: npm publish