Scrub PII from promo assets + document WS transport posture (#24)

* Redact PII from poster and codex screenshot

Poster (docs/harness-demo-poster.jpg): blackbox over the personal
email in the welcome banner ("you@example.com's Organization")
and over the Claude Code /remote-control session URL
(https://claude.ai/code/session_xxxxxxxx).

Codex screenshot (docs/screenshot-codex.png): blackbox over the
OAuth authorization URL (code_challenge, client_id, state).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Redact PII from demo video

docs/harness-demo.mp4: persistent ffmpeg drawbox overlays cover the
welcome-banner email and the Claude Code /remote-control session
URL for the full 28-second duration (the banner scrolls ~60px up
around t=22s, so the redaction boxes are sized to cover both
pre- and post-scroll positions). Re-encoded with libx265.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Delete unreferenced root screenshot.png

Identical bytes to docs/screenshot.png; only docs/og/build.py
references the docs/ copy, so the root duplicate is unused.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Document WS transport security posture in README

Note in the Network access section that the remote-control
WebSocket transport is off by default, bearer-token-authed, and
localhost-bound when enabled — so a reader understands the
posture without reading the source.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: frenchie4111

README.md

@@ -46,6 +46,8 @@ Grab the latest release from the [releases page](https://github.com/frenchie4111
 
 Harness makes outbound network calls to two places: `api.github.com` (for PR status, check runs, and review state on worktrees that have an open PR) and this project's own GitHub releases feed (for auto-updates via `electron-updater`). If you have the [`gh`](https://cli.github.com) CLI installed and authenticated, Harness will optionally pick up your token from it instead of requiring you to paste a PAT.
 
+The optional remote-control WebSocket transport (used by the web client) is off by default, bearer-token-authed, and bound to `127.0.0.1` when enabled; opting in to LAN access (binding to `0.0.0.0`) is a separate explicit config flag.
+
 ## Uninstallation
 
 1. **Remove the Claude Code hooks** (do this while Harness is still running). Open Settings → **Agent** → **Status hooks** and click **Remove hooks**. This strips Harness's entries from `~/.claude/settings.json` and leaves any user-authored hooks intact.