Restructure README and add per-audience setup + security docs

[rajeeja]

Summary

• New top-level README with a "Pick your path" router (local / connect to existing HPC endpoint / stand up new endpoint) and a 5-step local install. Stops at "want HPC?" and links out.
• New SECURITY.md with a three-audience threat model: local, remote-as-user, remote-as-operator. The operator section includes concrete payload-on-disk impact (verified against a real NCAR endpoint) and a hardening checklist.
• New docs/remote-hpc.md for HPC users connecting to an existing Globus Compute endpoint. Prereqs pinned at the top, 5 numbered steps with time estimates, troubleshooting table at the bottom.
• New docs/operating-an-endpoint.md for the person standing up the endpoint. 8 numbered steps including a service-account request email template, Slurm and PBS configs, MEP allowlist path, and day-2 ops.

Why

Today users have to read 7+ overlapping files to figure out which path applies to them, and security guidance is scattered. This PR establishes three front doors keyed to who the reader is, leaves the existing site-specific quickstarts (chrysalis/improv/ucar) in place, and gives sysadmins a single page to send to support.

Test plan

• `uv run pre-commit run --all-files` (clean)
• `uv run pytest tests/ --ignore=tests/test_remote_agent.py` (293 passed)
• Render the new pages on GitHub to confirm tables/blockquotes look right
• Follow-up: consolidate `docs/getting-started.md`, `docs/hpc.md`, `docs/globus-compute.md` (now superseded) — separate PR

Notes

• Existing files in `docs/` are untouched to avoid breaking external links. Consolidation in a follow-up.
• `uv.lock` was repeatedly being touched with a stray 0.1.0 → 0.1.1 bump by `uv run`; explicitly checked-out to keep this PR docs-only.