v0.4.1 sync: build and CI fixes, settings presets D440-D447, outside PRs

build-pc.sh Windows temp-dir re-exec fixes; CI pin actions and no-cache ROM
handling; original-N64 and Deck presets; D440 preset labelling; D442 All
unlocked as a RAM/query-time override; D443 settings values (MSAA 16x,
Restart game); D444 front-end Previous/Next paging; D447 Original-aspect
pillarbox/letterbox. Outside contributions by dolent: PRs #120 and #121 (relabelled D445,
D446), merged as dolent's original commits.

Refs: D440 D441 D442 D443 D444 D445 D446 D447 D387 D283 #120 #121

.github/SECURITY.md

@@ -1,12 +1,40 @@
 # Security Policy
 
 This project is a non-commercial, fan-made research port. It has no server
-component and ships no binaries. The realistic security surface is:
+component, no networking of any kind, and no telemetry. Each release ships
+prebuilt Windows and Linux binaries, but never a ROM or any game asset — you
+supply those yourself from a copy you legally own. The realistic security
+surface is:
 
 - the PC port executable parsing your own ROM and asset files at load time
   (a malformed ROM/asset could in principle crash it or worse), and
 - the build/extraction scripts and CI workflow.
 
+A full walkthrough of what a release actually installs on your machine, and
+what a from-source build pulls in, is in
+[`docs/security-and-fidelity-status.md`](../docs/security-and-fidelity-status.md).
+
+### Why the binaries are unsigned
+
+The Windows `.exe` and the Linux build are **not code-signed** — this is a
+free, single-developer, non-commercial hobby project with no code-signing
+budget, not a sign of anything wrong with the binary. Two things you may
+run into as a result:
+
+- **Windows SmartScreen** may show "Windows protected your PC" on first
+  run. Click "More info" → "Run anyway."
+- Some antivirus engines flag `ge007-convert.exe` (the one-time ROM-asset
+  converter bundled in the release) specifically, because it's packaged
+  with PyInstaller's `--onefile` mode — a well-known trigger for heuristic
+  AV engines industry-wide, unrelated to what this project's code actually
+  does. The game launches this converter itself on the first run, when the
+  derived asset folders are missing, so an AV prompt can appear at that
+  moment rather than when you unpack the release. If you want to verify what
+  it does, its full source is `prepare-assets.py`, shipped right next to it in
+  the same bundle folder. The build pins the PyInstaller version and the CI
+  actions it uses (by commit SHA), so what ships is reproducible from this
+  repository.
+
 ## Reporting a vulnerability
 
 Please **do not** open a public issue for a security problem.
@@ -38,4 +66,6 @@ errors, and anything requiring a ROM or assets we do not distribute.
 
 ## Supported versions
 
-Only the tip of the default branch is supported. There are no releases yet.
+Only the tip of the default branch and the
+[latest release](https://github.com/jkdansereau/goldeneye-pc-port/releases/latest)
+are supported.