Prepare private Beta security roadmap and least-privilege manual CI

MANIFEST.sha256.json

@@ -13,18 +13,19 @@
     "ARCHITECTURE.md": "2d0167efe06df1eb10f0386b3a48c743fcd555a57e7a5247f1af24e6d2524701",
     "CHANGELOG.md": "6a813acbc64657a7aa3df39e9abdc5bb2e6a00b25eabae05940e8f4b7831fc68",
     "CONTRIBUTING.md": "ff542d9f3161d4034a9b1eb24c48fdbcf2834813e728a348393df8787825999d",
-    "CURRENT_STATUS.md": "e8a1dd24324dd0e50756b9a89d08a67eebc010bfb52e846731690bd32d6e779c",
+    "CURRENT_STATUS.md": "82632c2351318c115322ec0537450014b7306fa9bcdfaddf6b1d9a6b804bfa7f",
     "DEVELOPMENT_BRIEF.zh.md": "2826390187880a27ee3a14405ee2bff012fdda532fa567ee16643959842193f9",
     "IPQUALITY_COVERAGE.md": "57bb12daad9b52e2c9ff55a7de5dafcd7278e57ea86a2545e15701cfb4b27fdd",
-    "KNOWN_LIMITATIONS.md": "77ad98e35bff5b60e99ba8ab74a5ada94858fe7a75add42dc821e8ed6577bcd9",
+    "KNOWN_LIMITATIONS.md": "c874b401af6bed7539dceaab9a15fe0c74653846ff1f2bad142687c68461fc93",
     "OPEN_SOURCE_REFERENCES.md": "f75ae885e4f31902a77e3eea90cfee3a3a0b38c0772ba70dc8935448fe483051",
     "OPEN_SOURCE_RESEARCH.md": "b55daa9b58b49fc2acd7cc3ecec077a64ea5bb68be2893ed2f616cb581434803",
     "PROBLEM_BACKLOG.md": "e4ba9faf47c25ebb8af39f5d22185c1ccf191d9248f60fd6985406be34e42403",
     "PUBLIC_BETA_CHANGE_REPORT.md": "33f3eefb59f8445ccd974b3a40881febbfe3855baeb188c9edfe55167bbcf6e9",
-    "README.en.md": "feafce6619ef02958a40f370da63c66d06c83d391e581973d1e435db8dcc0de2",
-    "README.md": "abcd0e5413d2c8b60adafe5a926c0fb4b924ee4e354498ac37d39dce0996098e",
-    "RELEASE_NOTES.md": "23283cb2b6636380f61a5dac27639ad2ea2275971524b7051ca3063fc19cc92c",
+    "README.en.md": "b7472946383d790249f0612ea045b128f9b1309bb9eefb78f46701fde6ef5224",
+    "README.md": "7a3071c306cfe3403401c61a85ce4cd23b1761efee7e8cf56cb5adc8aee32325",
+    "RELEASE_NOTES.md": "020d12ae499c5049b0362b3ac97e6e43a1956b4035594450da5da669d3818b01",
     "SECURITY.md": "24dd0d7306bd3643f9d9773db51ea777d9049337afdd92d5ce3c6dfd38b2c81f",
+    "SECURITY_ROADMAP.md": "1eb9799e41419201701b4cc5bf49045b02b63021044285eec4e9661aa591f949",
     "TEST_PLAN.md": "1c4cbc8d4608a3983c6ed7de782c9e7f0deba25b9b8f191e3eb1cd5f4757dd29",
     "THIRD_PARTY_NOTICES.md": "f6aaa77f22195916ca027e7756d74e3a206399c9e6a6c399d530a21a05f4e768",
     "USER_CHECKLIST_STATUS.md": "ef3255e772499813fb2c28cb9bdad3eac2ab970f4d4aff7e8a827c0f2c1b45f5",
@@ -81,13 +82,14 @@
     "tests/test_server_info.py": "52bd0f409cc01ffaabb3fde25a0781dab286065d475f2c639ed586b89b5608c2",
     "tests/test_stage1.py": "9413983d55805a663d5b831b64146f191846192788ff014f4db256c5f68d3b9a",
     "tests/test_suite.py": "61c83fe1bdb54deea884120ae8f9cc17373cdbe2f27bc84b600f86e614b1b5cb",
+    "docs/CI.md": "b0a391418bb98d077eb46c1ca4f4ba4cedf6aa7b45ce8cef682e20c88576ba3b",
     "docs/DATA_SERVICES.md": "d91be04176e6dda22c831cb9cd24f968ad82c1851c53bb6cbf356c51141b4a4c",
-    "docs/GITHUB_ABOUT.md": "c4c03497033313c09e38f98403224924f04720351c48578349da9a9dd3b5062f",
+    "docs/GITHUB_ABOUT.md": "cff3e044fcdc8f702fd2ee0b36f5e854c0ef710d127dbdb2544424d216d0ad60",
     "docs/history-beta-before-p0-20261101.md": "fd1130fcf1e896b84954e1a6805ecf75dd88fb5ec7c2938ee8d0fce0e8488be0",
     "docs/pre-alpha-README.en.md": "0f6c892c62870b925ccdefd2659f09ef49c8c34d7a763cb922b6f121f5972843",
     "docs/pre-alpha-README.md": "ebc76331f714158bb0f4d3b4bd4e20ac92713bece32cfafab4b1ff32cae3d4a1",
     "docs/status-history-before-2026-11-01.md": "28cd2e77331469b9ffd4b7f298ad6eaecefd48e00b6f7e2823b54d4cacab1ca0",
-    ".github/workflows/tests.yml": "ba27ec460fd71a2f9bbac20be0aa5b7043a14a04ae7c3ae0eaf5237cd72b4b5c",
+    ".github/workflows/tests.yml": "a0d3002520e97206d94aa3ff9ee02be81f062c0dbb280c579af29e9d95846a58",
     ".github/ISSUE_TEMPLATE/bug_report.md": "e0a64101b0552afc7bc0722379ade9e730faeb8e510ec89f6c2d177926c52a64",
     ".github/ISSUE_TEMPLATE/feature_request.md": "e4efabb0a5961e03344f59985797f4a349989d94ce3bd9edabf5f4d5a656bc68"
   }