docs: real end-to-end proof, GitHub alert blocks, release-ready wording

[onelrian]

Overview

Closes the gaps found in a full review of main before the first release: no GitHub alert blocks anywhere, no screenshots proving anything works (the docs restructure in #25 orphaned the one safe image without replacing it), and SECURITY.md/the Helm install docs used "before/after the first release" wording that goes stale the moment a release ships.

Relates to #22
Relates to #24

Key Changes

• examples/local-demo/: a real, runnable docker compose up (real Loki, a real syslog receiver, a disclosed NetBird API stub since no live account is available) that reproduces the exact setup the new screenshots show
• Three new screenshots (docs/images/live-*.png) captured from actually running that demo: startup and delivery logs, a real Loki query returning the delivered events, and live /healthz /readyz /metrics output. Removed the orphaned, unreferenced grafana_dashboard_example.png
• GitHub alert blocks ([!WARNING], [!NOTE], [!TIP]) in README and docs, each on a genuinely load-bearing fact (don't use latest in production, CURSOR_FILE needs durable storage, use _HEADERS_FILE for sink credentials), not decorative
• SECURITY.md and the Helm section of docs/INSTALLATION.md rewritten to describe a stable ongoing policy instead of a transitional pre-release state

Verification

Ran the exact committed examples/local-demo end to end (not just the scratch version used to draft it):

$ docker compose up -d --build
...
auditbridge-1  | INFO signal::sinks::http: Sent 3 events to sink 'loki' (http://loki:3100/loki/api/v1/push)
auditbridge-1  | INFO signal: Delivered 3 events to loki
auditbridge-1  | INFO signal::sinks::syslog: Sent 3 events to sink 'wazuh' (wazuh-receiver:1514)
auditbridge-1  | INFO signal: Delivered 3 events to wazuh
$ curl -s http://localhost:19090/readyz -w " [%{http_code}]"
ready [200]

Also confirmed via a direct Loki query that the delivered log bodies include initiator_email (the label-drift fix from #11 still holds), and via the syslog receiver's own log that RFC3164-framed events actually land over the wire, not just that the code compiles.

cargo test (28 passed), cargo clippy --all-targets -- -D warnings (clean), cargo fmt --check (clean), helm lint charts/auditbridge (clean) all still pass.

Out of Scope

Git history still contains the credential-exposed image blob from before #26; this was a deliberate decision (token already revoked, rewriting history not worth invalidating every existing clone/fork for an already-dead credential), not an oversight.