- README.md: full rewrite with architecture, quickstart, config examples,
privacy model, and contributing section (deduced from source)
- recorder.py: close leaked fd from mkstemp (SEC-2)
- gtkui.py: guard next() with default to prevent StopIteration (CQ-4)
- dependabot.yml: add pip ecosystem for linux/ deps (SEC-5)