Release binaries, security policy, and a full README

scripts/build-release.sh builds reproducible linux/amd64 and linux/arm64
archives with SHA256SUMS; the release workflow runs it on a v* tag after
vet, tests and govulncheck, and publishes the release. The README now
covers what the tool is, what it does step by step, why each decision is
made, how to deploy and run a mail host, the security model, and
troubleshooting. -h exits 0.

SECURITY.md

@@ -0,0 +1,43 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes go into the latest release. Older releases do not receive
+backported fixes; a fixed release is a download away, and the tool keeps no
+state of its own between runs.
+
+| Version | Supported |
+| --- | --- |
+| Latest release | :white_check_mark: |
+| Older releases | :x: |
+
+## Reporting a Vulnerability
+
+**Please do not open a public GitHub issue for security vulnerabilities.**
+
+Report them privately by emailing **johnellisATlinuxDOTcom**, with:
+
+- A description of the issue and its impact
+- Steps to reproduce
+- The ihasmail-oneshot version (`ihasmail-oneshot version`)
+- Whether it is in the tool itself or in the deployment it writes
+
+You should hear back within a few days. Once a fix is released, disclosure
+timing and credit are coordinated with you.
+
+## Scope
+
+In scope:
+
+- Secrets the tool generates or writes: file modes, where they end up, what
+  outlives the setup
+- The deployment it writes: what it publishes, and what it tells Stalwart to
+  trust (forwarded client addresses, addresses exempt from bans)
+- The Caddyfile and compose.yaml it renders
+
+Out of scope, and best reported upstream:
+
+- Vulnerabilities in Stalwart itself
+- Vulnerabilities in ihasmail itself — see
+  [its security policy](https://github.com/Coffey-Labs/ihasmail/security/policy)
+- Vulnerabilities in Caddy or Docker