doc: add Security model section to README

Document the layered security model:

• Filesystem access policy (allow/deny lists)
• Command execution restrictions (git, pytest only)
• Tool-server subprocess isolation (minimal env forwarding)
• Git authentication (temporary GIT_ASKPASS helper)
• Telegram access control (TELEGRAM_ALLOWED_CHATS)
• API key handling (never forwarded to child processes)
• ASCII trust-boundary diagram