ci: publish a GitHub release alongside the PyPI upload, plus project docs

[schiz0x00]

Three things, all housekeeping.

Release pipeline. The tag job already tagged the published commit but stopped there, so v0.1.0 sat on PyPI with no release page. It now runs gh release create after pushing the tag, with --generate-notes plus a short install blurb linking the matching PyPI version. Checkout gains fetch-depth: 0 so note generation can see the previous tag. v0.1.0 was backfilled by hand; everything after this merge gets one automatically.

README fix. The README advertised a short console script called bb. pyproject.toml installs instadata and idata — bb has never existed, and this text is also what renders on the PyPI page. Corrected in both places.

SECURITY.md and CONTRIBUTING.md. Brings the repo level with image-proxy and kclaude: a private disclosure path with the scope spelled out (cookie/proxy leakage, path traversal from attacker-controlled shortcodes), and the contribution rules — branch off dev, ruff + pytest, and the tier-ladder invariant that RateLimitError must not escalate.