Add GitHub CI security and release workflows

README.md

@@ -620,6 +620,38 @@ If a command fails, the daemon error includes a `next:` line for common recovery
 paths such as importing a peer card, running `auth explain`, granting a missing
 capability, or creating/registering a missing resource.
 
+## CI, Security, And Releases
+
+GitHub Actions workflows live under `.github/workflows/`:
+
+- `ci.yml` runs formatting, clippy, docs, `cargo check`, and workspace tests on
+  Linux, macOS, and Windows. Cross-platform test jobs set
+  `GETH_TEST_SKIP_IROH=1` so deterministic unit and integration coverage can be
+  required while Iroh-heavy daemon-to-daemon tests continue to mature.
+- `ci.yml` also has a visible Ubuntu Iroh integration smoke job for the full
+  network-heavy paths. It is marked `continue-on-error` until the local Iroh
+  tests are reliable enough to make required.
+- `security.yml` runs RustSec `cargo audit` on pushes, pull requests, manual
+  dispatch, and a weekly schedule.
+- `codeql.yml` builds the Rust workspace for GitHub CodeQL analysis.
+- `dependency-review.yml` blocks pull requests that introduce vulnerable
+  dependency changes at moderate severity or higher.
+- `release.yml` builds release archives for Linux, macOS, and Windows, uploads
+  them as artifacts, and publishes them on `v*` tags or manual dispatch.
+- `.github/dependabot.yml` opens weekly Cargo and GitHub Actions update PRs.
+
+Local equivalents remain:
+
+```sh
+cargo fmt --all -- --check
+cargo check --workspace --all-targets
+cargo clippy --workspace --all-targets -- -D warnings
+GETH_TEST_SKIP_IROH=1 cargo test --workspace
+```
+
+Run the Iroh-heavy tests without `GETH_TEST_SKIP_IROH` when working on endpoint,
+peer-card, sync, overlay, or remote module behavior.
+
 ## Authorization Direction
 
 The MVP defines the split between: