docs+chore: fix listener bind-default wording; archive release-and-ci-hardening

[setuidloot]

Changes

Docs — correct misleading security wording

The README listed "Secure Defaults: Listeners default to 0.0.0.0 for maximum compatibility" — but 0.0.0.0 binds all interfaces, which is the least-restrictive option, not a secure default. The code confirms ReverseListenerBindAddress defaults to 0.0.0.0 throughout, and bind "validation" only checks the address is a wildcard or a host-configured IP.

• Reframed as a compatibility default (needed so reverse shells from remote targets can connect back) with an explicit ⚠️ warning and guidance to restrict via reverselistenerbindaddress.
• Corrected the "bind address validation" and "input sanitization" descriptions to match what the code actually enforces (and noted the new control-char injection guard).
• No behavior change — changing the default to loopback would break remote callbacks; this is a doc-accuracy fix.

Chore — archive shipped OpenSpec change

release-and-ci-hardening is fully delivered (v3.0.1 released). Archived it and synced its specs (ci-quality-gates, sbom-release-integration) into openspec/specs/. One deferred follow-up remains noted in the archived tasks: flip mypy from advisory to blocking once the type backlog is cleared.

🤖 Generated with Claude Code