Consolidate to one repository, and rename the masthead art

[kengio]

Why

Development happened in a private repository. This one was created from an orphan-root commit carrying a curated subset, with public-tree-exclude.txt naming what stayed behind and sync-from-public.py guarding against the next release silently reverting anything merged here first.

That arrangement is ending — this repository becomes the only one. Everything worth keeping has to arrive before the private one is deleted.

What comes over

Seventeen paths existed nowhere else. These eleven have lasting value:

• The five diagram pairs — apply semantics, destructive utilities, mode lifecycle, pipeline, pipeline branching (light + dark)
• scripts/gen-olaf-diagrams.py — the generator that produces them

They were withheld because no published document referenced them, never because a check objected. The exclude list said so in as many words:

None of these are excluded for safety — the release scanner reports no finding against any of them.

Verified before bringing them: the generator does not produce the four diagram pairs already published here, so nothing shipped was ever at risk of becoming unregenerable. These five simply had no copy outside one laptop.

What deliberately does not come over

public-tree-exclude.txt and sync-from-public.py. Both exist to manage two repositories that cannot merge into each other — the orphan root means main and this repo share no ancestry. With one repository there is no subtraction to describe and no drift to guard against, and carrying them would leave instructions for a process that no longer runs.

Masthead rename

olaf-lockup-* → olaf-banner-*.

The bytes were replaced in #3 but the filenames were not, and GitHub serves README images through a cache keyed on URL — so viewers kept getting the previous image from an unchanged address. A new name is the only thing that reliably invalidates it. It also describes the file better: this is a banner.

README.md, docs/brand-guidelines.md, assets/brand/README.md and PROVENANCE.md all follow the rename, and every recorded hash was re-verified against the file on disk.

Verification

Gate	Result
scripts/lint.sh	pass — now covering the newly added generator
pytest	1,657 passed
check_public_release.py tree .	PASS, 0 findings
PROVENANCE hashes vs disk	all 5 match
References to olaf-lockup remaining	0
Broken image references in the tree	none

The pinned Gitleaks scan needs a container runtime and runs in CI.