v1.0.5 — security docs + hardening

v1.0.5 — security docs + hardening

• Removed the legacy cmd /c start open-file RPC from plugin/host.js (the only variable-path shell call)
• Added SECURITY.md (execution model, spawn inventory, read/write boundaries, model downloads) — shipped in the npm package
• npm README gained a Security section

Code behavior is otherwise identical to 1.0.4.

Install

npm install dsh-kb-rag

Assets

• dsh-kb-rag-1.0.5.tgz — identical to npmjs.com/package/dsh-kb-rag
• Source zip/tar.gz — auto-generated for this tag