chore(#52): release mechanics for the first Hex publish (v0.1.0)

[milmazz]

Release-mechanics PR for the first Hex publish. Draft on purpose — merge this at publish time, not before.

What

• mix.exs: version 0.1.1-dev → 0.1.0.

  ⚠️ Maintainer decision point: nothing was ever published to Hex, so the first public version should be 0.1.0 (the 0.1.1-dev counter never shipped). If you disagree, this is the one line to change.

• CHANGELOG.md: retitled ## Unreleased → ## v0.1.0 (unreleased) with a release-date placeholder to fill in at tag time. Existing bullets kept as-is; the only commits since the changelog was written are a transitive-deps security bump and an internal upsert perf tweak, neither changelog-notable for a first release.
• README.md (Installation section only): Hex dependency snippet {:bier, "~> 0.1.0"} is now primary, with the git dependency kept as the secondary "track main" option.
• SECURITY.md (new): supported versions (latest 0.1.x, mirroring the README's alpha warning), private reporting via GitHub security advisories, 7-day initial-response window.

No code, workflow, or docs/ changes. Nothing is tagged or published by this PR.

Release checklist (maintainer)

# 1. Fill in the CHANGELOG release date, then merge this PR.
git checkout main && git pull

# 2. Tag and push
git tag -a v0.1.0 -m "v0.1.0"
git push origin v0.1.0

# 3. Publish (also builds and pushes docs to hexdocs)
mix hex.publish

# 4. Verify
#    https://hex.pm/packages/bier
#    https://hexdocs.pm/bier/0.1.0

# 5. Start the next dev cycle: bump mix.exs @version to "0.2.0-dev",
#    add a fresh "## Unreleased" section to CHANGELOG.md, commit to main.

Verification

• mix deps.get, mix format --check-formatted, mix compile --warnings-as-errors, mix credo --strict, mix docs --warnings-as-errors, and MIX_ENV=test mix compile --warnings-as-errors all pass locally.
• CI (conformance suite) is the judge for the rest; this PR touches no lib/ code.

🤖 Generated with Claude Code