Improve onboarding and security guidance

[keida]

Summary

• Improve English and Simplified Chinese onboarding with a value sentence, Quick Start, official .NET 8 Desktop Runtime link, release downloads, and a tested PowerShell checksum command.
• Correct docs/DEVELOPMENT.md to describe the current WPF/native boundary, Settings controls, build/test commands, and the published v1.1.0 publication boundary.
• Add SECURITY.md with supported versions, public-reporting safeguards, and the v1.1.0 local-authentication/data boundary.

Verification

• Product code changed: 0 files.
• PNG assets unchanged; no wpf/**, native/**, release, tag, or repository-setting changes.
• dotnet restore, WPF Release builds, and deterministic tests passed: 0 warnings / 0 errors; 31 fixtures / 58 checks.
• README checksum command executed against the downloaded v1.1.0 ZIP: SHA-256 matched SHA256SUMS.txt.
• Official .NET Runtime, release ZIP, and checksum links returned HTTP 200.
• All Markdown relative links resolved; English/Chinese parity assertions passed.
• git diff --check and privacy/absolute-path scans passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T08:29:18.193604Z	2bedd75	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2bedd75ab7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Verify the archive before running it

When a newcomer follows the numbered quick start, they run the executable in step 4 and only verify its archive in step 5, so a corrupted or tampered download has already executed before a mismatch can be detected. Move the checksum step immediately after the download and before extraction or execution; the Chinese quick start has the same ordering.

Useful? React with 👍 / 👎.