docs: CI additions, localization decision, upstream-merge path now CI-gated

Refs #53 #94 #95 #98

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

README.md

@@ -119,6 +119,7 @@ The Lotus Chat logo (`public/res/Lotus.png`) is a derivative work based on the o
 - Pending knock requests shown in the members list for room admins with a live badge count on the Members button
 - Homeserver support contact displayed in Help & About (MSC1929)
 - Server notice rooms are visually distinct from regular DMs
+- Known limitation: the UI is English-only for now — Lotus-added surfaces aren't yet localized, so language selection is restricted to English rather than showing a partially-translated UI (see [`LOTUS_FEATURES.md`](./LOTUS_FEATURES.md#localization))
 
 ---
 
@@ -229,3 +230,5 @@ NODE_OPTIONS=--max_old_space_size=6144 npm run build
 ```
 edit → commit → git push    →    ~11 min    →    live at chat.lotusguild.org
 ```
+
+CI (`.gitea/workflows/ci.yml`) also runs a gitleaks secret scan, builds and smoke-tests the Docker image (`docker build`, boot + security-header checks against `docker-nginx.conf`), and dependency updates are proposed weekly by Renovate (`.gitea/workflows/renovate.yml`, config in `renovate.json`).