[mahach666]

What changes and why

Brings documentation, CI and project settings in line with the conventions used in RvtIO.

Fixes

• The IOViewer package was built without its XML documentation file: the IsPackable condition in Directory.Build.props is evaluated before the project sets IsPackable, so it never matched. The flag now lives in IOViewer.csproj; lib/net8.0/IOViewer.xml and lib/net10.0/IOViewer.xml are in the package.
• release.yml runs only for version tags again (no workflow_dispatch), fails on any gh release error and no longer overwrites assets of an existing release (--clobber removed).
• tools/pack-release.ps1 fails when git archive fails and runs it against the repository root.
• Docs no longer claim .mtl material support or mesh simplification (LOD); neither exists in the code.

Documentation

• README: corrected SDK version, clarified there is no direct dependency on RvtIO/IfcIO/NwcIO, added an Autodesk trademark notice (Revit, Navisworks, ViewCube, TimeLiner).
• SECURITY.md: supported versions and scope (crafted inputs, HTML injection, output paths, the local --serve server).
• CONTRIBUTING.md: development setup, clean-room and personal-data policy, code conventions, PR requirements.
• CHANGELOG.md: Keep a Changelog header and an [Unreleased] section.
• Copyright holder is mahach666 in LICENSE, package metadata and README.

Repository settings

• global.json: SDK 10.0.100, latestFeature, no prerelease; workflows use global-json-file, action versions match RvtIO.
• Tests target .NET 8 and .NET 10.
• NuGet audit, Dependabot, .gitattributes (LF), issue and PR templates.
• threejs removed from package tags (three.js is not used).

How it was checked

• dotnet build IOViewer.slnx -c Release has no warnings
• dotnet test IOViewer.slnx -c Release passes (11/11 on net8.0 and net10.0)
• Generated HTML and JSON for the same inputs are unchanged (no library or viewer code changed)
• No customer models, personal data, vendor code or third-party JavaScript is added

Also ran dotnet pack (XML docs present in the nupkg) and dotnet docfx docfx.json --warningsAsErrors (0 warnings).

Notes for reviewers

• The release workflow now rejects a re-pushed tag for an existing release instead of overwriting its assets. The v0.1.0 tag was moved twice before; that path is intentionally closed.
• The workflows were not run on GitHub before this PR; they match RvtIO line for line apart from names.
• Not in this PR: XML comments for the 187 undocumented public members (CS1591 stays suppressed), renaming the public TimeLiner API, and the empty catch around opening the browser in --serve.