docs: README rewrite + community files (LICENSE, CONTRIBUTING, CoC, SECURITY)

[dpsoft]

GitHub's community profile flagged this repo for missing the four standard files (LICENSE, CONTRIBUTING, CODE_OF_CONDUCT, SECURITY). At the same time, the README hit a new reader with an 80-line ASCII architecture diagram in slot 2 — before they'd seen a single command. This PR fixes both, plus a small .gitignore patch for stray local files.

What's in here

1. Community files (commit e9c23855)

• LICENSE — canonical Apache 2.0 text from apache.org.
• CONTRIBUTING.md — build/test/PR conventions, redirects to BUILDING.md, states in-scope vs. out-of-scope (no cluster-wide watchers, no telemetry — keeps feature triage consistent with the project's stated philosophy).
• CODE_OF_CONDUCT.md — Contributor Covenant 2.1, reporting contact set to maintainer email + GitHub Security Advisories.
• SECURITY.md — vuln reporting path (Security Advisory preferred, email fallback), explicit threat model and scope. Calls out that the agent runs with CAP_SYS_ADMIN/CAP_BPF/CAP_PERFMON/CAP_SYS_PTRACE/CAP_CHECKPOINT_RESTORE, so privilege-escalation and kernel-DoS reports are taken seriously.

2. .gitignore patch (commit 826259ec)

Stray files that keep showing up in git status:

• isolate-*-v8.log (Node.js V8 logs from JS workload runs)
• pmu.txt (stray PMU capture)
• .codex (Anthropic CLI cache)
• test/workloads/go/{cpu_bound,io_bound} (built binaries; sources stay tracked)

3. README rewrite (commit 28ecd33f)

New top-of-file:

• One-line italic tagline distinct from the prose intro.
• Badge row: CI, Tests, Go reference, Go version, license.
• Auto-style table of contents.
• --- separators between H2s (visual hierarchy).

New sections:

• Quickstart — 3 commands (build, setcap, capture). First content section.
• What it does — single table with all four modes (on-CPU, off-CPU, PMU, library).
• vs the alternatives — concrete row-by-row comparison against perf record / parca-agent / pyroscope-ebpf / py-spy. Helps people pick the right tool, which is more honest than vague positioning.
• Profiling inside a Kubernetes pod — short subsection mentioning the namespace-aware --pid + pprof k8s labels we just shipped (feat(perfagent): namespace-aware --pid + k8s pprof labels #14), with links rather than re-explaining.

The architecture deep-dive ASCII diagram and procmap.Resolver narrative are preserved verbatim — just moved below user-facing content so they don't gate first-read comprehension.

BUILDING.md also gets a Go 1.26+ bump (was 1.25+) plus a note that GOTOOLCHAIN=auto handles older system Go.

Deliberately not in scope

Borrowed-organization-only from vm0's README; skipped the SaaS-style elements that don't fit a Linux profiler:

• No giant centered SVG hero (a small banner would be fine later; not now).
• No audience-segmented sections ("for founders / for sales").
• No Discord-as-primary-channel, no Trendshift, no contrib.rocks (one-engineer project, not the right signal).
• No "your data stays yours" SaaS pitch — though the SECURITY.md and README's value prop both call out the local-only / no-telemetry stance, which is the substance of that claim.
• No external marketing site links.

Diff shape

LICENSE              + 202 (new, canonical Apache 2.0)
CONTRIBUTING.md      +  76 (new)
CODE_OF_CONDUCT.md   + 130 (new, Contributor Covenant 2.1)
SECURITY.md          +  56 (new)
.gitignore           +  14 / 0
README.md            + 130 / -110 (rewrite)
BUILDING.md          +   1 / -1 (Go version bump)

Test plan

• git status clean after rebuilding test workloads (gitignore covers them)
• CI: lint, build amd64+arm64, unit tests amd64+arm64, integration tests
• Visual: render the README on github.com and confirm badges resolve, TOC anchors work, and section flow reads quickstart-first.