v0.2.3

Changed

• Removed public personal contact details from package, citation, security, and
  conduct metadata.
• Run the container image as an unprivileged user and restrict CI token
  permissions to read-only repository contents.
• Bind dev and Docker Compose servers to localhost by default, keep private
  files out of Docker build contexts, run Compose with a read-only root
  filesystem, and keep HTTP-triggered subscription CLI backends disabled unless
  explicitly enabled.
• Keep full feedback-example snapshots opt-in in the starter config.

Fixed

• Hardened live-data fetchers to use HTTP(S) client calls with status checks and
  defused XML parsing for RSS feeds.