Prepare ms-private 0.0.1 release candidate

SECURITY.md

@@ -0,0 +1,9 @@
+# Security
+
+ms-private runs locally and can make administrator-level changes. Review the source and the concrete plan before applying. Never upload recovery journals, identifiers, tokens, browsing histories or unredacted installed-app inventories to a public issue.
+
+The Windows release is self-contained and requests elevation with an embedded `requireAdministrator` manifest. Before launch, compare its SHA-256 with the adjacent checksum over a trusted channel. The executable is not code-signed yet. At runtime it verifies the embedded payload, installs it under `%ProgramFiles%\ms-private\runtime`, and refuses or repairs hash, path, reparse-point and undeclared-file failures before starting the wizard.
+
+Report reproducible bugs with the Windows edition/build, PowerShell version, ms-private revision and a minimal redacted error. For a security issue, use the repository owner's private reporting channel when available; do not publish an exploit or personal report by default.
+
+App reports are an audit trail, not a backup or rollback mechanism. Use trusted original installers to recover removed apps. Keep policy journals local and restore them on the originating installation.