chore: track task #21 done + add security audit report

- mark task #21 (commit-race + collapsible panels fix) as done — followup to v0.8.1 release commit 95c48c7
- add SECURITY_AUDIT_2026-04-25.md from the deep audit of v0.8.0 (1 critical, 4 high, 5 medium, 4 low findings — kept for reference; remediation tracked separately)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.taskmaster/tasks/tasks.json

@@ -261,18 +261,18 @@
         "description": "Fix UI race in commitAllBatch + collapse Sources/Labels/Recent Jobs panels",
         "details": "Fix 1: in polling tick (index.js ~1217), don't downgrade local 'committing' status back to 'awaiting_review' from server. Fix 2: wrap Sources, Labels and Recent Jobs panel bodies in collapsible div with chevron toggle, default collapsed; lazy-load on first expand.",
         "testStrategy": "",
-        "status": "in-progress",
+        "status": "done",
         "dependencies": [],
         "priority": "high",
         "subtasks": [],
-        "updatedAt": "2026-04-26T11:01:34.264Z"
+        "updatedAt": "2026-04-26T11:09:41.057Z"
       }
     ],
     "metadata": {
       "version": "1.0.0",
-      "lastModified": "2026-04-26T11:01:34.265Z",
+      "lastModified": "2026-04-26T11:09:41.059Z",
       "taskCount": 21,
-      "completedCount": 14,
+      "completedCount": 15,
       "tags": [
         "master"
       ]