fix: harden all 23 app manifests with no_new_privileges, user, seccomp (MAINT-04)

Added no_new_privileges: true, user: 1000, and seccomp_profile: default
to all app manifests. Created community app review checklist.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/morphos-server/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: morphos-server