docs(release): prepare documented release candidate

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project are documented here.
 
 ## [Unreleased]
 
+### Documentation
+- Document release-candidate tarball verification and record the pre-release
+  installer security review and its operational limitations.
+
 ### Fixed
 - Register the project-local plugin directory instead of prompting OpenCode to
   download the unpublished package from npm; enable the namespaced tool through