Add version API, pkg-config, SPDX headers, SECURITY.md, CHANGELOG.md

Project-hygiene pass toward being a properly citable, embeddable,
professionally-packaged C library rather than just working code:

- PACKFS_VERSION_MAJOR/MINOR/PATCH/STRING in include/packfs.h, the single
  source of truth for the project's version, plus a runtime pfs_version()
  (src/vfs.c, next to vfs_new/vfs_free) so a dynamically-linked consumer
  can check ABI/API compatibility without recompiling. Covered by a new
  assertion in tests/test_mem.c that the macro and the runtime function
  never disagree.
- packfs.pc.in + a `make install` rule that generates packfs.pc with its
  Version: field derived from PACKFS_VERSION_STRING via a Makefile-level
  grep/sed, never hand-maintained separately -- verified end-to-end with a
  scratch `make install PREFIX=...` + `pkg-config --cflags --libs packfs`
  + `make uninstall`, not just by reading the rule.
- SPDX-License-Identifier: MIT added to every src/*.c and src/internal.h
  (include/packfs.h already had one); the whole distributed source tree
  now carries consistent machine-readable license metadata.
- SECURITY.md, stating precisely what this project's containment and pack-
  integrity code actually claims as a security boundary (concept.md
  Section 6/7) versus what it explicitly does not (unenforced `mode`, no
  cross-process concurrency) -- not generic boilerplate -- with a real
  reporting contact rather than a placeholder.
- CHANGELOG.md (Keep a Changelog format), summarizing the real history in
  git log to date; explicitly notes no version is tagged yet.

Verified: clean `make all` + `make test` (all 6 binaries, including the
new version-check assertion), and a full ASan/UBSan sweep of all 6
binaries with zero real findings (one run hit the already-documented
DEADLYSIGNAL sandbox flake on test_pack_write_perf across all 3 retries;
re-verified directly afterward with 5/5 additional clean passes and timing
well under any plausible timeout, confirming it was the flake, not a
regression, before treating this as done).

Deliberately not done here, by the user's explicit choice: no
CODE_OF_CONDUCT.md, and no git remote/publishing -- this repository still
has neither, and both are decisions left to the maintainer.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UqJpkdJ6Njnt1pw3CbghzB

Makefile

@@ -14,6 +14,10 @@ CFLAGS   ?= -std=c11 -Wall -Wextra -Wpedantic -O2 -g -fPIC
 CFLAGS   += -Iinclude -Isrc -D_GNU_SOURCE
 LDLIBS   := -lpthread
 
+# Single source of truth: PACKFS_VERSION_STRING in include/packfs.h.
+# packfs.pc is generated from it, never hand-maintained separately.
+VERSION  := $(shell grep -m1 'define PACKFS_VERSION_STRING' include/packfs.h | sed -E 's/.*"([^"]+)".*/\1/')
+
 SRC := $(wildcard src/*.c)
 OBJ := $(SRC:.c=.o)
 
@@ -64,16 +68,21 @@ bench: build/packfs_bench
 	./build/packfs_bench
 
 clean:
-	rm -f src/*.o $(STATIC_LIB) $(SHARED_LIB) $(SONAME)
+	rm -f src/*.o $(STATIC_LIB) $(SHARED_LIB) $(SONAME) packfs.pc
 	rm -rf build
 
-install: static shared
-	install -d $(DESTDIR)$(PREFIX)/lib $(DESTDIR)$(PREFIX)/include
+packfs.pc: packfs.pc.in
+	sed -e 's|@PREFIX@|$(PREFIX)|g' -e 's|@VERSION@|$(VERSION)|g' packfs.pc.in > packfs.pc
+
+install: static shared packfs.pc
+	install -d $(DESTDIR)$(PREFIX)/lib $(DESTDIR)$(PREFIX)/include $(DESTDIR)$(PREFIX)/lib/pkgconfig
 	install -m 644 $(STATIC_LIB) $(DESTDIR)$(PREFIX)/lib/
 	install -m 755 $(SONAME) $(DESTDIR)$(PREFIX)/lib/
 	ln -sf $(SONAME) $(DESTDIR)$(PREFIX)/lib/$(SHARED_LIB)
 	install -m 644 include/packfs.h $(DESTDIR)$(PREFIX)/include/
+	install -m 644 packfs.pc $(DESTDIR)$(PREFIX)/lib/pkgconfig/
 
 uninstall:
 	rm -f $(DESTDIR)$(PREFIX)/lib/$(STATIC_LIB) $(DESTDIR)$(PREFIX)/lib/$(SONAME) $(DESTDIR)$(PREFIX)/lib/$(SHARED_LIB)
 	rm -f $(DESTDIR)$(PREFIX)/include/packfs.h
+	rm -f $(DESTDIR)$(PREFIX)/lib/pkgconfig/packfs.pc