docs: update README for v2.4.0, fix CI fmt, add security-audit workflow

README updates:
- RTK section: 33 subcommands → 40 parsers + 141 TOML rules
- Stats table: v2.4.0 benchmark data (ig −15.5% bytes vs rtk)
- Filter coverage comparison table (ig: 106 tools vs rtk: 41)
- RTK functional gaps documented (grep -c/-l, smart dirs)
- Binary size: ~5MB → ~9MB
- Test count: 438 → 557 unit + 49 golden
- Historical v1.10.0 benchmark collapsed into <details>

CI fix:
- rustfmt: collapse multi-line closure in env_cmd.rs

Security:
- Add security-audit.yml (daily npm audit + obfuscation scan)