raposza/tools: docs/security-review.md

<!-- Copyright (c) 2026 bentzn --> <!-- SPDX-License-Identifier: Apache-2.0 --> # Security posture **This is a REVIEW, not an audit.** It was written by the people who wrote the code, from a static reading of this tree on 2026-09-25, read again on 2026-09-26 against the tree released as 0.4.0, on 20