Public-usage review: LogQ fix, CLI parity, repo hygiene

[tanaysd]

Summary

End-to-end review of the repo for public consumption now that
tanaysd/mmoe-recsys is public. Findings are catalogued in the new
PUBLIC_REVIEW.md. The fixes that can be made cheaply without
reshaping the public API are applied here; everything else is documented
so a public reader knows the posture is deliberate.

Local sanity (re-run after every commit): uv run ruff check .,
uv run ruff format --check ., uv run mypy packages/, uv run pytest -q
all pass — 127 tests pass (was 118; +9 new tests for LogQ, seed,
and bulk-insert behaviors).

Findings catalogued in PUBLIC_REVIEW.md

#	Severity	Area	Fixed in this PR?
1	HIGH	ML correctness — LogQ correction silently a no-op	✅
2	MEDIUM	Docs/CLI drift — --resume-from undocumented in CLI	✅
3	MEDIUM	Quick Start perf — ~60k SQLite fsyncs in populate	✅
4	MEDIUM	Reproducibility — no global seed in training	✅
5	MEDIUM	Docs/safety — README over-sells deployability	✅ (warning added)
6	LOW	Repo hygiene — missing CONTRIBUTING/SECURITY/etc.	✅
7	LOW	Docs polish — "5-step" vs 6 numbered steps	✅
8	LOW	Docs — no protobuf regen command	✅
9	INFO	gRPC TLS/authn/etc. — by design, documented	Doc-only

Commits (one logical change each)

1. docs: add public-usage review covering 9 findings — adds
   PUBLIC_REVIEW.md with the full report.
2. fix(retrieval): LogQ correction was silently a no-op —
   np.log(max(v, 1)) clamped every popularity value to log(1) = 0;
   replaced with np.log(max(v, 1e-12)). Unknown-item fallback unified
   with the in-vocabulary path. Adds tests/retrieval/test_dataset_logq.py.
3. feat(training): add --resume-from and --seed CLI flags —
   adds the CLI flags the README already advertised, adds
   recsys_common.seed.set_seed() (seeds Python/NumPy/Torch), wires
   both train_retrieval.py and train_ranking.py to seed on startup.
   Adds tests/common/test_seed.py.
4. perf(serving): batch SQLite writes in populate_feature_store —
   adds put_*_bulk methods using executemany inside a single
   transaction; scripts/populate_feature_store.py switches to them.
   Adds round-trip and empty-input tests.
5. docs(community): add CONTRIBUTING, SECURITY, issue/PR templates, dependabot
   — six standard community files.
6. chore: ruff auto-fixes (isort + format) — picked up by lint
   after the seed import was added to training scripts.
7. docs(readme): production-readiness section + 6-step pipeline + dev posture
   — adds a "Production readiness" gap table, softens "production-grade"
   headline copy, fixes the 5 vs 6 step inconsistency, documents
   --resume-from, documents --seed, documents protobuf regeneration.
8. docs(changelog): record 0.6.0 entries.

Notes for the reviewer

• The LogQ bug is the only behavior change in this PR that affects the
  actual training math. Existing checkpoints will still load fine — the
  fix only changes how the next training run subtracts popularity from
  in-batch similarity logits. The integration tests
  (tests/integration/test_serving_pipeline.py) still pass end-to-end.
• The per-row SqliteFeatureStore.put_* methods are intentionally kept;
  they are part of the FeatureStore Protocol surface and are used in
  several tests. The bulk variants are additive.
• SECURITY_REVIEW.md is left untouched as a historical record;
  SECURITY.md links to it.

Checklist

• uv run ruff check . passes
• uv run ruff format --check . passes
• uv run mypy packages/ passes
• uv run pytest passes locally (127 tests)
• Added or updated tests for the change (LogQ, seed, bulk)
• Updated README.md and CHANGELOG.md