docs: prepare v0.1.0 release

[builtbyhuy]

Summary

• publish the exact full-SHA GitHub Action usage
• record v0.1.0 evidence, artifact digests, and limitations
• update the security support and private-reporting contract
• retain explicit HOLD for adoption and Codex OSS application claims

Verification

• npm test: 158 pass, 0 fail, 1 expected local strict skip
• README Action YAML parse: PASS
• npm pack --dry-run: PASS
• evidence ZIP: 21 files, SHA-256 3bcec67f5e1c3833bc5de684b1be6a7aa46859dd326cb9a776eeaf9b774b06f7
• independent release review: PASS
• git diff --check