feat(security): semgrep+trivy CI, pre-push hooks, auto docker release, badges (#14)

- release chain: publish-pypi now calls docker-publish via workflow_call after
  the GitHub Release (a GITHUB_TOKEN-created tag cannot fire tag-push triggers,
  which left the image unbuilt). docker-publish resolves the version from the
  call input or the tag ref.
- security.yml: blocking semgrep SAST (p/python, p/security-audit, p/secrets)
  and trivy fs scan (vuln+misconfig+secret, HIGH/CRITICAL) on push/PR/weekly.
- pre-push: .pre-commit-config.yaml (ruff, ggshield, semgrep, sanity hooks) at
  the pre-push stage; install with `pre-commit install --hook-type pre-push`.
- findings triage: 6 semgrep logger-credential false positives annotated with
  justified nosemgrep (messages log status/host/port, never secrets); wildcard
  CORS justified (MCP clients, credentials disabled). Dockerfile fixed for
  real trivy findings: non-root USER, --no-install-recommends.
- README: CI/Security/PyPI/Python/ghcr/license + tool badges.

Verified: semgrep PASS, trivy PASS, image builds and serves /healthz as the
non-root user, 129 tests passing.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>