Clarify GoldKey Guard’s security boundary and add CI

[noah-ing]

Summary

• lead with GoldKey Guard’s execution-path boundary, beta status, limitations, and reproducible verification
• remove the stale public pilot intake and align the remaining engagement-budget language
• make Node and Foundry scripts portable
• add pinned read-only CI, private-reporting guidance, and explicit MIT terms for Solidity files

Verification

• JavaScript syntax and package metadata checks
• Solidity formatting check
• GitHub CI: service, enforcer, and contract tests