docs(readme): add local-first privacy section - #3

What

Adds a Local-First Privacy subsection to the README: no network calls at diff time, no telemetry/accounts, baselines as committed repo files, CI stays inside your perimeter.

Why

Roadmap item G5 — context/ROADMAP.md WS-G: "Local-first privacy story (no data leaves machine) as a selling point". Agent trajectories contain prompts, tool outputs, and customer data; privacy is a real differentiator vs hosted eval platforms.

How

• Positioned as a subsection of the pitch (after non-goals, before Installation).
• Four concrete claims tied to actual mechanics (--baseline files, GITHUB_TOKEN in the action, pure-local computation), ending with a one-line contrast against hosted platforms.
• Product surfaces only — website untouched per current focus.

Testing

• Docs-only change; uv run python -m pytest -> 205 passed

Checklist

• Exactly one logical change in this PR
• make lint passes
• uv run python -m pytest is green (205 passed)
• Docs updated if user-facing
• CHANGELOG entry — n/a (README only)
• Conventional title: docs(readme): add local-first privacy section