Tags: arin-jaff/TrainingGeeks

Desktop: disable hardened runtime for the ad-hoc build

The sealed ad-hoc signature applied the hardened runtime to the bundled
Node, which kills V8 (cannot reserve JIT memory) without the allow-jit
entitlements. Hardened runtime only matters for notarization, which
early-access builds don't do yet — verified locally that re-signing node
without the runtime flag boots to READY. The Developer ID lane will need
hardenedRuntime + JIT entitlements together (noted in the roadmap).

Open-source scaffolding: AGPL-3.0 license, contributing/security docs…

…, issue/PR templates, dependabot