ICYLAB OS - sanitized preproduction release v5

This package intentionally excludes:
- core/private_config.php
- database dumps
- runtime logs/cache
- generated billing PDF/XML files
- user-uploaded documents

Create a rotated private configuration outside the document root or as
core/private_config.php with mode 0600. Run scripts/billing_production_preflight.php
before using production data. Production DTE issuance remains blocked.
