docs: prepare v2.8.4 release

[xxvcc]

Summary

• restore the mirror-first 30-second quick start and document its exact trust boundary
• split user-facing README content into bilingual installation, operator, and security guides
• align release, contribution, security, and PR guidance with the single-maintainer mirror workflow
• ignore unrelated sudoers drop-ins that happen to have valid username filenames

Verification

• ordinary and race Go tests
• root integration tests in isolated Debian containers, including the mount-capable CLI suite
• vet and staticcheck with ordinary and integration tags
• govulncheck v1.6.0: no reachable vulnerabilities
• ShellCheck, shell syntax, mirror receiver tests, and actionlint
• amd64/arm64 static builds and qemu arm64 version probe
• fresh mirror installs on Debian 12, Ubuntu 24.04, Alpine 3.22, and Rocky 9
• real systemd/sshd PTY lifecycle: language, menu, invite, status, doctor, revoke, timer cleanup, uninstall