docs: add security.md — trust model and its current limits

[tildesrc]

What

Adds docs/security.md, a single honest page on panopticon's security posture, and links it from the README and the overview's "Where to go next".

The trust story was scattered (the docker_in_docker warnings in repos.md/layers.md) and some real limits weren't written down anywhere. This page states the model plainly, including where it stops.

Contents

• Isolation — per-task container, clone, and branch; the --dangerously-skip-permissions rationale (the container is the sandbox); nothing reaches main without the operator's review gate.
• docker_in_docker — --privileged ≈ host root; off by default; trusted repos only.
• Networking — containers reach the host via host.docker.internal; the task service defaults to 0.0.0.0:8000 (all interfaces), so the bind address is a security control.
• Trust boundary (stated plainly) — the control plane does not authenticate callers; any task_id is trusted over REST/MCP, so one container can mutate another task. Fine for a single trusted operator; a real concern before multi-user or shared-network runners. Tracked as the P1 cleanup in design/BACKLOG.md.
• Secrets — 0600 env-file injected via --env-file; long-lived non-rotating setup-token; manual rotation.
• What leaves the machine — the determinism invariant as a data-flow boundary: the control plane makes no model calls; they happen only inside task containers.
• A checklist before widening the trust radius.

Every claim was verified against the code before writing; the doc cites the relevant source files. Full plan: the task's plan.md artifact.