Prepare DAppNode Nexus SDK for public release

[Marketen]

Summary

• keep the DAppNode Nexus SDK name and existing repository name
• rewrite the README for standalone users on any computer or server
• make DAppNode an optional installation path rather than a requirement
• publish the maintained Nexus Gateway trust policy used for verification
• add an importable root nexus package for applications embedding the SDK
• add Apache-2.0 licensing, contribution guidance, and a security policy
• remove implementation-level Nitro, PCR, policy-schema, and deployment documentation from the public README

The SDK verifies a fresh Gateway attestation before it returns a client or opens a local listener. Applications can mount its OpenAI-compatible handler, use its in-process HTTP client with the official OpenAI Go package, call chat/model methods directly, and inspect or export verification evidence. The DAppNode package remains an optional deployment of the same library and CLI.

The removed technical README has been preserved outside the repository for maintainers.

Public Go API

• nexus.New(ctx, Config) — verifies the live Gateway before returning
• Handler() — mounts the SDK in an existing Go HTTP server
• HTTPClient() — connects another OpenAI-compatible Go SDK without a TCP listener
• ChatCompletions() and Models() — direct OpenAI-compatible calls
• Verify(), Verification(), and Evidence() — fresh verification, status, and signed evidence
• Flush() and Close() — persist local verification history when configured

The CLI now consumes this same public API, so the embedded and standalone paths do not maintain separate security-sensitive compositions.

Validation

• go test -race ./...
• go vet ./...
• go build ./...
• external module import and compile of the root nexus package
• official openai-go/v3 client compile and request through HTTPClient()
• secret scan of the working tree: no leaks (the sole history match is an 18-character README placeholder, not the current environment key)
• live initial attestation, evidence export, and explicit re-verification: passed

Live Gateway issue found

The current https://nexus-api-tee.dappnode.com deployment returns HTTP 500 from both /v1/models and authenticated chat completions. The same completion failure occurs through the embedded API and the standalone CLI, while the same API key succeeds against the hosted non-TEE Nexus endpoint. The opt-in live integration test records this accurately; end-to-end live inference should be rerun after the TEE Gateway is fixed.

Publication sequence

1. Resolve or explicitly accept the live TEE Gateway inference issue above.
2. Merge this PR.
3. Enable private vulnerability reporting.
4. Change repository visibility to public.
5. Update the coordinated optional DAppNode package PR to the final SDK main commit, rerun its image build, and merge it.