docs: rebuild org landing page, add LICENSE and SECURITY.md

The README of this repo renders as the org front page on
git.fromaitochitta.com/open. It was 5 lines and 209 bytes: a category
label, and a single navigation link that pointed away from the instance.
A visitor arriving from LinkedIn had no way into the 23 repos without
leaving the site they had just reached.

- README: a thesis (work that can be checked), navigation by purpose in
  five groups covering all 22 other repos, a maturity column read from
  the status-* topics that already exist on 22 of 23 repos, a verified
  two-line install block, and links that go INTO the instance. The link
  to fromaitochitta.com stays, last, as additional context.
- LICENSE: MIT, matching the other repos in the org (closes A8).
- SECURITY.md: org-level contact at the address already published on
  four other repos, with a realistic best-effort response process.

Absolute URLs rather than relative paths: how Forgejo resolves relative
links when rendering .profile/README.md on the org page is not measured,
and a pretty relative path that renders to 404 is worse than a long
absolute one that works. 25 links checked, 24 resolve 200 pre-push; the
25th is SECURITY.md itself. Known-negative control returns 404.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N1mHqwhG7BgaiUkaZ5PC7i

README.md

@@ -1,5 +1,89 @@
-# fromaitochitta / open
+# From AI to Chitta — open
 
-Companion repos, plugins, and tools for [From AI to Chitta](https://fromaitochitta.com).
+Tools for working with AI in a way that can be checked.
 
-Browse all repos at [fromaitochitta.com/open-source](https://fromaitochitta.com/open-source).
+Everything here comes out of daily practice as an AI advisor: plugins that make
+Claude Code sessions disciplined and reproducible, security scanners that
+compute rather than guess, and frameworks for the parts of AI work that are
+usually asserted instead of measured. Built in the open, used every day.
+
+**New here?** Start with
+[voyage](https://git.fromaitochitta.com/open/voyage) — brief, research, plan,
+execute, review — or
+[llm-security](https://git.fromaitochitta.com/open/llm-security), OWASP-aligned
+scanning for Claude Code projects.
+
+## Workflow and discipline for Claude Code
+
+| Repo | What it does | Maturity |
+|---|---|---|
+| [voyage](https://git.fromaitochitta.com/open/voyage) | Contract-driven pipeline: brief, research, plan, execute, review | stable |
+| [config-audit](https://git.fromaitochitta.com/open/config-audit) | Multi-agent analysis and optimisation of Claude Code configuration | stable |
+| [graceful-handoff](https://git.fromaitochitta.com/open/graceful-handoff) | One-command session handoff into the STATE.md continuity system | stable |
+| [repo-mailbox](https://git.fromaitochitta.com/open/repo-mailbox) | Local mailbox for coordination between sessions in different repos | beta |
+| [repo-standard](https://git.fromaitochitta.com/open/repo-standard) | Per-repo gate for this org's presentation standard | experimental |
+| [app-creator](https://git.fromaitochitta.com/open/app-creator) | Pre-design pipeline from app concept to Voyage-ready briefs | experimental |
+| [ktg-plugin-marketplace](https://git.fromaitochitta.com/open/ktg-plugin-marketplace) | The plugin catalog — install any of the above from here | stable |
+
+## Security
+
+| Repo | What it does | Maturity |
+|---|---|---|
+| [llm-security](https://git.fromaitochitta.com/open/llm-security) | Scanning, auditing and threat modeling for Claude Code projects | stable |
+| [llm-security-commons](https://git.fromaitochitta.com/open/llm-security-commons) | Runtime-neutral core: detector data and normative contracts | beta |
+| [llm-ingestion-pipeline-security](https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security) | Write-time defence for Python pipelines that persist LLM output | beta |
+
+## Architecture, cost and data
+
+| Repo | What it does | Maturity |
+|---|---|---|
+| [ms-ai-architect](https://git.fromaitochitta.com/open/ms-ai-architect) | Structured architecture guidance for the Microsoft AI stack | stable |
+| [portfolio-optimiser](https://git.fromaitochitta.com/open/portfolio-optimiser) | Multi-agent cost optimisation on Microsoft Agent Framework, gated by a deterministic validator | experimental |
+| [portfolio-optimiser-claude](https://git.fromaitochitta.com/open/portfolio-optimiser-claude) | The same method on the Claude Agent SDK | experimental |
+| [portfolio-optimiser-commons](https://git.fromaitochitta.com/open/portfolio-optimiser-commons) | Framework-neutral shared core: normative specs and golden fixtures | experimental |
+| [llm-ingestion-okf](https://git.fromaitochitta.com/open/llm-ingestion-okf) | Open Knowledge Format ingestion library: connectors and bundle inbox | alpha |
+
+## Leadership and practice
+
+| Repo | What it does | Maturity |
+|---|---|---|
+| [okr](https://git.fromaitochitta.com/open/okr) | OKR guidance for Norwegian public sector, on 4-month tertial cycles | stable |
+| [ki-produktivitetsmodell](https://git.fromaitochitta.com/open/ki-produktivitetsmodell) | Three levels of organisational AI productivity, for public-sector leaders (Norwegian) | — |
+| [ai-psychosis](https://git.fromaitochitta.com/open/ai-psychosis) | Meta-awareness tools for healthy AI interaction patterns | stable |
+
+## Content and design
+
+| Repo | What it does | Maturity |
+|---|---|---|
+| [linkedin-studio](https://git.fromaitochitta.com/open/linkedin-studio) | Content engine for Claude Code: posts, carousels, video, newsletters | beta |
+| [claude-design](https://git.fromaitochitta.com/open/claude-design) | Facilitator for prompting Claude Design, from idea to ready prompt | alpha |
+| [playground-design-system](https://git.fromaitochitta.com/open/playground-design-system) | Framework-free CSS design system for plugin playgrounds | beta |
+| [human-friendly-style](https://git.fromaitochitta.com/open/human-friendly-style) | Shared plain-language output style for the marketplace | stable |
+
+## Maturity labels
+
+Every repo carries a `status-*` topic, and the tables above read from it.
+`stable` is in daily use and safe to depend on. `beta` works and is in use,
+with an interface that may still move. `alpha` is early and will change.
+`experimental` is research — read it, do not build on it yet.
+
+## Install
+
+Most of the Claude Code work here ships as plugins. Add the marketplace once,
+then install what you want:
+
+```bash
+claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git
+claude plugin install voyage@ktg-plugin-marketplace
+```
+
+The first line only registers the catalog — it installs nothing on its own.
+The Python and framework repos are cloned and used directly; each has its own
+README.
+
+## License and security
+
+MIT unless a repo says otherwise — `ki-produktivitetsmodell` is CC BY 4.0.
+Security contact: [SECURITY.md](https://git.fromaitochitta.com/open/.profile/src/branch/main/SECURITY.md).
+
+More context and writing at [fromaitochitta.com](https://fromaitochitta.com).