chore(repo): P0 hygiene for the alpha reset

- gitignore .serena/ and Client/tauri-client/.env; untrack the .env
  (the KLIPY key it held is treated as burned; rotation + server-side
  proxy tracked for P3)
- CI: verify generated sqlc output (make sqlc-verify) on the ubuntu leg
- CHANGELOG: honest reset narrative (v1.1.0-alpha series), remove
  references to deleted roadmap files
- delete stale docs/phase-a-status.md; fix dangling ref in
  docs/plans/slash-commands.md
- add root SECURITY.md (GitHub-surfaced policy; reporting works while
  the source repo is private)
- docs/audit-2026-04-07.md: add maintained finding-closure table

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/plans/slash-commands.md

@@ -2,7 +2,7 @@
 
 **Status:** design only, not implemented
 **Owner:** TBD
-**Tracks:** PHASE_D_PARITY_TODO.md item #1
+**Tracks:** deferred feature backlog (post-beta; see CHANGELOG "Deferred work")
 **Estimated effort:** 1–2 weeks of focused work
 
 ## Why