Harden HDMI recovery and add tested user installer release tooling

SECURITY.md

@@ -31,8 +31,21 @@ This prevents the systemd user service from hanging on a password prompt.
 
 ## Boot safety
 
-DRM hotplug events can occur during boot. The watcher therefore verifies that the current user has an active Wayland session with a valid VT before any recovery or VT switch is attempted.
+DRM hotplug events can occur during boot. The watcher and helper verify the current UID, an active Wayland session on seat0, and a valid VT. The helper rechecks the session after waiting and immediately before switching. IPC must identify an available configured Hyprland output. This check is not atomic with the VT switch; use one local Hyprland session per user.
 
 ## Reporting security issues
 
 If this repository is published publicly, report security-sensitive findings privately through the repository owner's preferred security contact rather than opening a public issue containing exploitable details.
+
+## Runtime and configuration
+
+Runtime state requires a private, user-owned mode-0700 XDG_RUNTIME_DIR; there is
+no shared /tmp fallback. Configuration is trusted Bash executed as the user.
+Never run the installer or recovery scripts as root or allow untrusted users to
+edit the scripts/config. Only chvt belongs in sudoers.
+
+## Best-effort recovery
+
+The helper checks both VT permissions and attempts to return on catchable signals
+or failures. SIGKILL, power loss and persistent kernel/sudo failures can still
+leave another VT active. The temporary VT can briefly expose another console.