Add threat model section to README

[DarkaMaul]

Summary

• Adds a Threat Model section to the README addressing [QUESTION] Is it meant to be used as just a terminal for CC while we do everything else outside the devcontainer? #29
• Explains the primary threat (Claude running arbitrary commands on the host with bypassPermissions)
• Clarifies the intended workflow: the devcontainer is a full development environment, not just a Claude terminal
• Documents SSH agent forwarding semantics (socket forwarded, private keys stay on host)
• Adds SSH agent to the Security Model's "Not sandboxed" list

Closes #29

Test plan

• Verify README renders correctly on GitHub
• Confirm cross-links to Security Model and Network Isolation sections work

🤖 Generated with Claude Code