Perch v1.37.0

docs(security): add security policy, privacy note, third-party notices

SECURITY.md points at private vulnerability reporting and documents release
verification via 'gh attestation verify'. PRIVACY.md records Perch's verified
network behavior: no telemetry/analytics; only GitHub (updates), Anthropic
usage, and Google Cloud public pricing. THIRD-PARTY-NOTICES.md attributes
bundled deps, including the OFL-required attributions for the Inter and Geist
Mono fonts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U8fSpRqdaWs3GU8GSEFBJs