chore(typo): retire tous les tirets cadratins/demi-cadratins + garde CI

Remplace les 547 tirets cadratins (U+2014) et demi-cadratins (U+2013) des fichiers versionnés par la ponctuation contextuelle adaptée (point médian, deux-points, virgule, parenthèses ; tiret simple pour les plages), sur 122 fichiers (appli, vitrine, doc, tests, workflows, scripts).

Ajoute le job CI « lint-dashes » (git grep -P) qui échoue si un tiret cadratin/demi-cadratin réapparaît, hors logo binaire et captures brutes du terminal (fidélité des fixtures de détection de dialogue).

SECURITY.md

@@ -1,7 +1,7 @@
 # Security Policy
 
 Arboretum is a self-hosted daemon that serves a web dashboard to drive git worktrees and the
-Claude Code sessions running on them. **A web terminal is remote code execution by design** — that
+Claude Code sessions running on them. **A web terminal is remote code execution by design**: that
 is the product, not a bug. Arboretum's security model is therefore built on *structural* guards
 (loopback-only binding, authenticated access, strict Origin checks) far more than on cryptography
 alone.
@@ -13,7 +13,7 @@ environment, see [`docs/ENTERPRISE_DEPLOYMENT.md`](docs/ENTERPRISE_DEPLOYMENT.md
 ## Threat model
 
 - **Single-user by design.** Arboretum runs on the owner's machine and is meant for one operator.
-  There is no multi-tenant isolation and no RBAC — and none is claimed.
+  There is no multi-tenant isolation and no RBAC, and none is claimed.
 - **Loopback by default.** The server binds `127.0.0.1`; `config.ts` *refuses* any non-loopback bind
   unless you pass `--i-know-this-exposes-a-terminal`. Remote access is expected via **Tailscale Serve**
   (TLS + tailnet identity), never by opening a port.
@@ -31,7 +31,7 @@ environment, see [`docs/ENTERPRISE_DEPLOYMENT.md`](docs/ENTERPRISE_DEPLOYMENT.md
 | Sessions | Cookie is an HMAC-SHA256 signed payload, `HttpOnly` + `SameSite=Strict`, `Secure` when HTTPS | `packages/server/src/routes/auth.ts` |
 | CSRF / WS | Strict `Origin` check on every `/api/**` and `/ws` request (anti cross-site WS hijacking) | `packages/server/src/app.ts` |
 | CSRF | Mutations carrying a body must be `application/json` | `packages/server/src/app.ts` |
-| Rate limit | Global login rate limit with exponential backoff (not per-IP — Tailscale fronts everything as 127.0.0.1) | `packages/server/src/auth/service.ts` |
+| Rate limit | Global login rate limit with exponential backoff (not per-IP, Tailscale fronts everything as 127.0.0.1) | `packages/server/src/auth/service.ts` |
 | HTTP headers | CSP, `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, `Referrer-Policy`, `Permissions-Policy`, conditional HSTS, `Cache-Control: no-store` on API; `Server` header stripped | `packages/server/src/app.ts` |
 | Injection | All SQL is parameterized; all git calls use `execFile` (no shell); path-traversal guards | `packages/server/src/**` |
 | Data at rest | DB file/dir forced to `0o600`/`0o700`; sensitive secrets (server secret, VAPID private key) encrypted with AES-256-GCM | `packages/server/src/db/index.ts`, `core/secret-box.ts` |
@@ -44,7 +44,7 @@ environment, see [`docs/ENTERPRISE_DEPLOYMENT.md`](docs/ENTERPRISE_DEPLOYMENT.md
 - **Long-lived API tokens.** Tokens do not expire by age (CLI automation stability) but can be revoked
   instantly, and `last_used_at` is tracked. Review and rotate tokens periodically.
 - **Encryption-at-rest key management.** With no `ARBORETUM_SECRET_KEY` set, the encryption key lives in
-  `dataDir/secret.key` (`0o600`) next to the database — this protects a leaked database *copy* (backup,
+  `dataDir/secret.key` (`0o600`) next to the database: this protects a leaked database *copy* (backup,
   WAL) but not a full `dataDir` compromise. For strong protection, set `ARBORETUM_SECRET_KEY` and store it
   separately from database backups. Full-DB SQLCipher is intentionally avoided (it breaks the `npx`
   prebuilt portability).
@@ -52,7 +52,7 @@ environment, see [`docs/ENTERPRISE_DEPLOYMENT.md`](docs/ENTERPRISE_DEPLOYMENT.md
 
 ## Reporting a vulnerability
 
-Please report security issues **privately** — do not open a public issue.
+Please report security issues **privately**: do not open a public issue.
 
 - Email: **security@johanleroy.fr** (or `contact@johanleroy.fr`).
 - Include a description, affected version, and reproduction steps.