README: state testing/audit/CI status explicitly

No behavior or code change -- documentation only. Makes explicit what
was previously only implied: self-distributed (not on WordPress.org),
not independently security audited, no CI pipeline yet, tested on
disposable WordPress environments rather than live production sites,
and automatic updates are inactive pending real update infrastructure.

README.md

@@ -24,6 +24,22 @@ configuration required.
 
 Everything works out of the box. There is nothing to configure to get protected.
 
+## Status
+
+This is a self-distributed release: it is not listed on WordPress.org and has not gone
+through that team's plugin review process.
+
+- **Not independently security audited.** It has been reviewed internally (code review,
+  static checks, a manual security pass over authentication/authorization/nonce/SQL
+  handling), but no third-party security audit or penetration test has been performed.
+- **No CI pipeline yet.** Tests are run manually before each release, not on every commit.
+- **Tested in sandbox/disposable WordPress environments.** Verification so far — install,
+  activation, all admin pages, deactivation, uninstall — was done on disposable WordPress
+  instances, not on live production sites.
+- **Automatic updates are not currently active.** The signed-update mechanism is built in
+  but requires production update infrastructure (a manifest server and signing key) that
+  is not yet deployed. See [Updating](#updating) below for how to update manually.
+
 ## Installation
 
 1. Download the latest release ZIP (see [Releases](#releases) below).