docs: changelog + README updates for PRs #150-#157 (Aikido security sweep)

[flupkede]

Summary

This PR backfills documentation for PRs #150–#157 — the Aikido security sweep and follow-up fixes — that landed in develop since the [1.1.30] changelog entry but were never changelogged or reflected in README. It also bumps the patch version to 1.1.31 for this documentation/version-tracking release.

This is a docs-only PR. No functional code changes.

What's documented

• 🔒️ fix: harden path-traversal vectors and CI credential persistence (Aikido) #151 — Critical path-traversal fixes (Rust + .NET) + CI persist-credentials hardening
• 🛡️ fix: defense-in-depth for ANSI injection, .git root walk, and Unix backslash collision (Aikido) #152 — ANSI-injection sanitization, .git-root rejection, Unix backslash path-cache collision fix
• 🔒️ fix: pin actions/checkout SHA in codeql.yml (supply-chain hardening) #153 — CodeQL checkout SHA pinning
• deps: cargo update + rmcp floor bump 1.5.0 → 1.8.0 (Aikido p82) #154 — rmcp 1.5.0 → 1.8.0 + ~100 transitive dependency CVE updates
• Add EmbeddingGemma retrieval support #155 — EmbeddingGemma model support entry (added per reviewer remarks)
• 🐛 fix: raise RLIMIT_NOFILE at serve startup — fd exhaustion silently wedges accept() #150 (external, @tony-nexartis) — RLIMIT_NOFILE fd-exhaustion fix
• 🔧 ci: skip CodeQL on fork PRs (upload cannot write security-events) #156 — Skip CodeQL analyze on fork PRs (restricted GITHUB_TOKEN can't upload SARIF upstream)
• 🐛 fix: byte-boundary panic (#148) + rmcp allowed_hosts env vars (#149) #157 — Byte-boundary panic fix (Panic: 'end byte index 100 is not a char boundary' during search result rendering (src/search/mod.rs:1227) #148, @tony-nexartise) + new CODESEARCH_ALLOWED_HOSTS / CODESEARCH_DISABLE_HOST_VALIDATION env vars (support allowed_hosts list #149, @stdweird)

Version bump

Cargo.toml → 1.1.31 (patch bump for this documentation release; no code logic changed).

Validation

Docs-only change. Local QC gate (fmt / check / clippy / cargo test --lib — 596 passed) run on push and is green.