Harden local builds and security guidance

[VAMPIRE0924]

Summary

• document the v2.0.0 security validation baseline and current deployment guidance
• clearly separate historical Go 1.20.14 findings from the current posture
• add a guarded local build entrypoint and acceptance check

Validation

• SECURITY.md link and whitespace checks passed
• build.sh safety check is included in the acceptance workflow