add publish infrastructure and update docs for public release

- publish/manifest: explicit file allowlist for public repo
- publish/CLAUDE.md: sanitized version (no personal data paths)
- publish/extract_config.example.yaml: generic paths and owner
- publish.sh: orphan-branch publish script (single squashed commit)
- site/.env.example: documents BINCIO_DATA_DIR and PUBLIC_EDIT_URL
- README.md: updated pipeline diagram, quick start, project layout
- CHEATSHEET.md: added bincio render and bincio edit sections,
  sidecar format reference, updated daily workflow

publish.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REMOTE="github-public"
+BRANCH="main"
+LOCAL_DIR="$(cd "$(dirname "$0")" && pwd)"
+PUBLISH_DIR="${LOCAL_DIR}/publish"
+MANIFEST="${PUBLISH_DIR}/manifest"
+DRY_RUN=false
+
+for arg in "$@"; do
+    case "$arg" in
+        --dry-run) DRY_RUN=true ;;
+        *) echo "Unknown argument: $arg"; exit 1 ;;
+    esac
+done
+
+if ! git -C "$LOCAL_DIR" remote get-url "$REMOTE" &>/dev/null; then
+    echo "ERROR: remote '${REMOTE}' not found."
+    echo "  git remote add ${REMOTE} https://github.com/brutsalvadi/bincio-activity.git"
+    exit 1
+fi
+if [[ -n "$(git -C "$LOCAL_DIR" status --porcelain)" ]]; then
+    echo "ERROR: uncommitted changes. Commit or stash first."
+    exit 1
+fi
+if [[ ! -f "$MANIFEST" ]]; then
+    echo "ERROR: manifest not found at ${MANIFEST}"
+    exit 1
+fi
+
+STAGING="$(mktemp -d)"
+trap 'rm -rf "$STAGING"' EXIT
+
+while IFS= read -r relpath || [[ -n "$relpath" ]]; do
+    [[ -z "$relpath" || "$relpath" == \#* ]] && continue
+    override="${PUBLISH_DIR}/${relpath}"
+    original="${LOCAL_DIR}/${relpath}"
+    dest="${STAGING}/${relpath}"
+    mkdir -p "$(dirname "$dest")"
+    if [[ -f "$override" ]]; then
+        cp "$override" "$dest"
+    elif [[ -f "$original" ]]; then
+        cp "$original" "$dest"
+    else
+        echo "ERROR: '${relpath}' in manifest but not found (no override, no original)"
+        exit 1
+    fi
+done < "$MANIFEST"
+
+echo "Files to be published:"
+find "$STAGING" -type f | sed "s|${STAGING}/||" | sort
+
+if $DRY_RUN; then
+    echo ""
+    echo "Dry run complete. No changes made."
+    exit 0
+fi
+
+git -C "$LOCAL_DIR" checkout --orphan _public_tmp
+git -C "$LOCAL_DIR" rm -rf . --quiet
+cp -r "${STAGING}/." "${LOCAL_DIR}/"
+
+TIMESTAMP="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+git -C "$LOCAL_DIR" add -A
+git -C "$LOCAL_DIR" commit -m "Published ${TIMESTAMP}"
+git -C "$LOCAL_DIR" push --force "$REMOTE" "HEAD:${BRANCH}"
+
+git -C "$LOCAL_DIR" checkout main
+git -C "$LOCAL_DIR" branch -D _public_tmp
+
+echo ""
+echo "Done: $(git -C "$LOCAL_DIR" remote get-url "$REMOTE")"