docs(release): prepare documented release candidate

docs/SECURITY-REVIEW.md

@@ -0,0 +1,44 @@
+# Pre-release security review
+
+## Scope
+
+Manual source review of the project installer, JSONC configuration edits, CLI,
+and packaged content before the first release. The review focused on path
+containment, symlink handling, file ownership, preserving user changes, and
+partial failures. This is not an independent audit, a guarantee against local
+filesystem attackers, or a review of provider/model behavior.
+
+## Result
+
+No release-blocking issue was identified for the documented project-local use
+on a trusted filesystem. The installer resolves the project root, restricts
+manifest paths to toolkit asset locations, rejects symlinked install paths and
+non-regular files, refuses unmanaged collisions, and verifies hashes before
+replacing or removing managed content. Configuration changes use JSONC edits
+and preserve unrelated entries. Deterministic tests cover collisions, modified
+files, symlinked install directories, and a tampered manifest.
+
+## Limitations and operational guidance
+
+- The installer does not defend against a concurrent process replacing a path
+  after it has been checked (a filesystem time-of-check/time-of-use race). Run it
+  only where another actor cannot concurrently manipulate the project tree.
+- The ownership manifest is ordinary project-local JSON, not an authenticated
+  record. It protects against accidental overwrite/removal, not a malicious
+  project owner who can edit both the manifest and files.
+- Uninstall removes managed files incrementally. If an I/O failure interrupts
+  it, the manifest is retained for recovery in normal mid-operation failures;
+  resolve the filesystem problem and rerun uninstall. Transactional rollback
+  for uninstall remains future work.
+- Provider-backed agent delegation and skill invocation have not been reviewed
+  or verified. The runtime smoke test only covered plugin activation and the
+  read-only status tool with a local mock provider.
+
+## Checks run
+
+- `npm run typecheck` — passed.
+- `npm test` — passed, 16 tests.
+- `npm run test:coverage` — passed; 87.4% lines, 95.23% functions, and 81.86%
+  branches.
+- `npm pack --dry-run` — passed; included runtime files, selected content,
+  licenses, notice, and README.