docs: update security, installation, and operations guidance for session-peer 1.0.3 #17

Summary

session-peer v1.0.3 updates SSH argument validation, standalone release verification, and Node Control login expiry. The existing skill v0.3.1 CLI examples remain compatible, but the skill documentation needs to explain the actions and boundaries that users should follow.

Scope

• Recommend Python runtime 1.0.3 or later for security fixes while preserving the meanings of runtime-min-version=0.9.1 and runtime-full-version=1.0.1.
• Explain the SSH option allowlist, standalone installation and updates from verified immutable releases, remote update behavior, and independent skill management.
• Explain Node Control's absolute 24-hour login expiry, separate device and account-session revocation, and separate Python package updates and hosted-service deployment.
• Preserve operator control over existing pairing bindings and prohibit automatic retries of uncertain deliveries.
• Keep the canonical SKILL.md, four README translations, usage guides, and validation consistent.

Verification

Validate version metadata and pinned installation tags, run the Skill Creator validator and Skills CLI discovery, and check the diff and PR CI.

Limits and integration

Runtime source changes, operational deployment, global skill installation, automatic merging, and skill tags or releases are outside this issue. After skill publication, synchronize the runtime repository's compatibility snapshot in a separate change.

References: v1.0.3 release notes, CLI reference, and verified installation procedure.