docs(security): document homelab architecture and agent-first audits

Add SECURITY.md covering the threat model, trust boundaries,
proportionate kernel/process hardening, the update/reboot routine and
remaining prioritized work. Record the dated read-only audit findings
(listeners, privileged workloads, effective RBAC, secret metadata and
sandbox/SSH boundaries) separately from planned controls and runtime
verification.

Define agent-first diagnosis: scoped root read-only access on homelab
hosts, and normal-user diagnostics on core desktops with no new sudo
grants. Add canonical domain-based k3s API endpoint regression tests,
record the unverified Darwin secret-ownership concern as WA-015, and
correct comments claiming mode 0000 blocks privileged root.

AGENTS.md

@@ -59,6 +59,11 @@ deployments. Keep repository guidance here; reusable global rules live in `agent
 - Use `lib.mkDefault` for defaults and `lib.mkForce` only when necessary.
 - Give module options a `description` and preserve platform-specific conditions.
 
+## Security
+
+Security architecture, control limitations, rollout checks, and prioritized work are documented in
+[SECURITY.md](./SECURITY.md). Keep it consistent with changes to security boundaries or defaults.
+
 ## Workarounds
 
 Temporary workarounds, version pins, carried patches, and known gaps are recorded in