polished items from the re-audit report by Claude, add Ubuntu live ISO method to README

src/App.tsx

@@ -552,9 +552,18 @@ function App() {
 
     // 6. Block Service Workers
     if (navigator.serviceWorker) {
+      // Block new registrations
       (navigator.serviceWorker as any).register = async () => {
         throw new Error('Network blocked: Service Workers disabled');
       };
+
+      // Unregister any existing service workers (defense-in-depth)
+      navigator.serviceWorker
+        .getRegistrations()
+        .then(regs => regs.forEach(reg => reg.unregister()))
+        .catch(() => {
+          // Ignore errors; SWs are defense-in-depth only.
+        });
     }
   };