Refresh README/docs for the current stack, add a security policy, note the external-PR pause, and remove dead config and workflows.