docs+release: Phase 4 launch artifacts

README hero with real screenshots, install/config/widget docs, goreleaser
for dash + dash-agent, GHCR release workflow, changelog, community files,
agent systemd unit and Dockerfile, version stamping via -X main.version.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+|---|---|
+| latest release | yes |
+| older releases | no |
+
+Dash is pre-1.0; only the latest release receives fixes.
+
+## Reporting a vulnerability
+
+Use GitHub's private vulnerability reporting:
+**Security → Advisories → Report a vulnerability** on this repository.
+
+Do not open a public issue for security problems.
+
+Please include:
+
+- affected version/commit
+- steps to reproduce or a proof of concept
+- impact assessment
+
+You will get an acknowledgement within a few days. If the report is accepted,
+a fix ships in the next release and you are credited in the advisory (unless
+you prefer otherwise).
+
+## Scope notes
+
+Dash is designed for trusted private networks — it ships **without
+authentication** by design. Exposure to the public internet is a deployment
+choice outside the project's control, but issues that remain exploitable on a
+LAN (SSRF in checkers, injection, token leakage, unsafe schemes) are in scope.