docs: accuracy pass -- live demo, SECURITY fixes, CHANGELOG

Andrew Dunnrequested to merge
docs/accuracy-and-changelog into main

Summary

  • README: drop dated attribution line; add live-demo link under What You Get
  • SECURITY: narrow supported versions to v1.0.0 (no fabricated patch series); replace vague email instruction with confidential-issue path + coordinated vulnerability disclosure process
  • CHANGELOG: new file in Keep a Changelog format; Unreleased section documents post-1.0.0 fixes already merged; v1.0.0 marks the initial release

Validation

  • go vet ./... clean (no Go changed)
  • No new deps, no CI config changes

Merge request reports