The README now leads with a security notice explaining that agents run with the host user's privileges and that channels and lanes do not sandbox shell or file access. It documents default collaborator invocation, what disabling sharing actually does, and keeping the host gateway private.

Inspired by [Collie's security notice](https://github.com/AltanS/collie#security--read-this-first), adapted to [Ace's trust model](https://github.com/githubnext/ace2/blob/main/docs/architecture.md#the-team).

Validation: checked the claims against Ace's current architecture and CLI; `bunx dprint check readme.md` and `git diff --check` passed. Only `readme.md` changes.

### Built in Ace

The edit, formatting checks, commit, push, and PR creation ran in the Ace channel `readme-security`. Codex was used for the initial request, source browsing, drafting, coordination, and an independent read-only review because Ace cannot yet host this Codex conversation; tracked in #9 under the dogfooding meta issue #5.