docs: add documentation and licensing

[nozaq]

Adds the repository README, licensing and security policy, and reworks the per-feature documentation.

Summary

The repository had no README, so a visitor could not tell what it publishes, who it is for, or how it relates to the images and templates repositories. This adds one, plus the MIT license and security policy it links to, and brings the feature documentation into a consistent shape.

README.md

Ordered for a reader arriving with no prior context:

• Features — one table carrying everything per-feature: what you get, and where it comes from and how it is verified.
• Why these features — the goals: minimal trusted upstreams, trusted material reviewed in this repository, self-contained installs, minimal images staying minimal, and rebuilds staying cheap.
• Quick start — adding a feature, and passing options.
• Versions and pinning — the four tags each release publishes and which of them move.
• Supply chain — what a reader is trusting, what can be inspected before pinning, how the trusted material changes, and what is not covered (no provenance attestation or SBOM).
• Testing, Related repositories, Contributing, Security, License.

Feature documentation

src/*/NOTES.md reworked into the same section order — requirements, usage, installed software, what is left out, supply chain, tips — with the key inspection command next to the key it inspects. src/*/README.md regenerated with devcontainer features generate-docs (CLI 0.88.0, the version CI pins); running it again is a no-op.

devcontainer-feature.json is untouched, so no feature version bump or republish is needed.

https://claude.ai/code/session_01Li88NWapAE1Uy9SKoEtCyF