fix(deps): add missing go.sum entry for luxfi/mdns + wire CI

[RTHYMS]

Summary

`go test ./...` against main fails to build, not run:

```
node.go:18:2: missing go.sum entry for module providing package
github.com/luxfi/mdns (imported by github.com/luxfi/zap); to add:
go get github.com/luxfi/zap
FAIL github.com/luxfi/zap [setup failed]
FAIL github.com/luxfi/zap/bench [setup failed]
FAIL github.com/luxfi/zap/examples/agents [setup failed]
FAIL github.com/luxfi/zap/examples/mcp-bridge [setup failed]
FAIL github.com/luxfi/zap/mcp [setup failed]
```

Fix

`go mod tidy` adds 2 lines (the `luxfi/mdns` h1 + go.mod checksum). After:

```
ok github.com/luxfi/zap 3.819s
ok github.com/luxfi/zap/mcp 0.692s
```

(3 examples / bench packages have no test files — `?`, not failures.)

The `go.sum` gap suggests whoever pushed last didn't run `go test ./...`. This PR also wires CI so that recurring is harder.

Drive-by

• `.github/workflows/ci.yml` — `go test -race ./...` on Go 1.22 and 1.23
• `SECURITY.md`
• CI badge

[abhicris]

Welcome to kcolbchain, @RTHYMS — glad you're here. 🌱

Here's what happens from this PR:

1. Our automated review looks for obvious issues (tests, secrets, size) within a couple of hours.
2. If it's clean and CI passes, we merge without back-and-forth.
3. If we need changes, we'll leave a specific comment — not a generic nit. Push another commit and we re-review.

While you wait:

• Run the repo's tests locally (see the repo README.md).
• Keep the PR scoped to one concern — bigger PRs land slower.
• Don't commit tokens or .env contents.

What happens after your first merge

• You're listed on https://kcolbchain.com/contributors/ (opt-out anytime via data/contributors-optout.txt).
• At 2+ merged PRs you're a Regular; at 5+ you're a Fellow — Fellows are the pool we invite first for paid research, partner-org gigs, and grant-funded work. Details: https://kcolbchain.com/docs/org-contribution-policy.html
• Looking for what to pick up next? https://kcolbchain.com/invitations/ lists open help-wanted / good-first-issue across every kcolbchain repo.

Thanks for writing the code. We're building this to last.