docs: consolidate security documentation and add landing page

- Move security-model.md, security-best-practices.md, and cvm-boundaries.md
  to docs/security/ subdirectory
- Add docs/security/README.md as security landing page with responsible
  disclosure policy
- Add dedicated Security section to main README with links to all security docs
- Add base image link to meta-dstack releases in README
- Add proof.t16z.com context explaining it's Phala's TEE attestation explorer
- Fix broken link in deployment.md (security-guide → security-model)
- Promote security audit to top of security-best-practices.md
- Rename "Dstack Logo Kit" to "dstack-logo-kit" to avoid URL encoding issues
- Remove dangling KNOWN_ISSUES.md reference from Rust SDK README

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: h4x3rotab

README.md

@@ -55,7 +55,7 @@ services:
       - "8000:8000"
 ```
 
-Deploy to any TDX host with the `dstack-nvidia-0.5.x` base image, or use [Phala Cloud](https://cloud.phala.network) for managed infrastructure.
+Deploy to any TDX host with the [`dstack-nvidia-0.5.x` base image](https://github.com/Dstack-TEE/meta-dstack/releases), or use [Phala Cloud](https://cloud.phala.network) for managed infrastructure.
 
 Want to deploy a self hosted dstack? Check our [full deployment guide →](./docs/deployment.md)
 
@@ -75,7 +75,7 @@ Your container runs inside a Confidential VM (Intel TDX) with optional GPU isola
 
 - **VMM**: Runs on bare-metal TDX hosts. Parses docker-compose files directly — no app changes needed. Boots CVMs from a reproducible OS image. Allocates CPU, memory, and confidential GPU resources.
 
-[Full security model →](./docs/security-model.md)
+[Full security model →](./docs/security/security-model.md)
 
 ## SDKs
 
@@ -100,14 +100,19 @@ Apps communicate with the guest agent via HTTP over `/var/run/dstack.sock`. Use
 - [VMM CLI Guide](./docs/vmm-cli-user-guide.md) - Command-line deployment
 
 **Reference**
-- [Security Model](./docs/security-model.md) - Threat model and trust boundaries
-- [Security Best Practices](./docs/security-best-practices.md) - Production hardening
-- [CVM Boundaries](./docs/cvm-boundaries.md) - Information exchange and isolation
 - [App Compose Format](./docs/normalized-app-compose.md) - Compose file specification
 - [Gateway](./docs/dstack-gateway.md) - Gateway configuration
 - [Design Decisions](./docs/design-and-hardening-decisions.md) - Architecture rationale
 - [FAQ](./docs/faq.md) - Frequently asked questions
 
+## Security
+
+- [Security Overview](./docs/security/) - Security documentation and responsible disclosure
+- [Security Model](./docs/security/security-model.md) - Threat model and trust boundaries
+- [Security Best Practices](./docs/security/security-best-practices.md) - Production hardening
+- [Security Audit](./docs/security/dstack-audit.pdf) - Third-party audit by zkSecurity
+- [CVM Boundaries](./docs/security/cvm-boundaries.md) - Information exchange and isolation
+
 ## Trusted by
 
 - [OpenRouter](https://openrouter.ai/provider/phala) - Confidential AI inference
@@ -123,7 +128,7 @@ dstack is a [Confidential Computing Consortium](https://confidentialcomputing.io
 
 ## Media Kit
 
-The dstack logo and branding assets are available in the [media kit](./docs/assets/Dstack%20Logo%20Kit/):
+The dstack logo and branding assets are available in the [media kit](./docs/assets/dstack-logo-kit/):
 
 - **Horizontal logos**: Primary and dark versions in PNG/SVG formats
 - **Vertical logos**: Primary and dark versions in PNG/SVG formats