Prepare private Beta security roadmap and least-privilege manual CI

KNOWN_LIMITATIONS.md

@@ -25,3 +25,5 @@
 - No Web UI, automatic proxy deployment or full management panel is provided.
 - Bandwidth `attempted` counts scheduled sample slots, including automatically
   skipped slots; it is not an actual network-request counter. Inspect sample errors.
+
+当前不具备一键安全加固或自动修复。未来遵循检测→解释→预览→确认→备份→执行→验证→回滚；回滚不能覆盖所有断网/重启/云安全组/宿主机故障。本轮只更新路线与私有发布准备。