SECURITY.md (contact, timelines)

[flyingrobots]

Context

Responsible disclosure and contact details.

Acceptance

• SECURITY.md added with contact and timelines

Links

• Parent: Epic: Security & Threat Model #10

[flyingrobots]

[soft-deps] v1

This task has soft dependencies on #3 (Spec Freeze RC), #4 (JSON Schemas), #5 (Examples Pack), #6 (Compliance Suite v1), #7 (Docs Site), and #8 (CI & Validation): governance and security docs reference these outputs, but drafting can begin in parallel.