Epic: Security & Threat Model

[flyingrobots]

Context

Capture a concise security posture and guidance.

Acceptance

• SECURITY.md (contact, timelines)
• Threat model (tamper, replay, time skew, policy bypass)
• Key guidance (Ed25519, rotation, trust roots, quorum)

[flyingrobots]

[soft-deps] v1

This task has soft dependencies on #3 (Spec Freeze RC), #4 (JSON Schemas), #5 (Examples Pack), #6 (Compliance Suite v1), #7 (Docs Site), and #8 (CI & Validation): governance and security docs reference these outputs, but drafting can begin in parallel.