P1: Add a security policy and a private disclosure channel

Why

The project is about to be public and will distribute binaries. There is no SECURITY.md and no private way to report a vulnerability: the issue tracker is public, and #106 explicitly expects responsible disclosure. A public deployment needs a channel and an expectation before the first report arrives, not after.

Scope

• Choose the private channel and write it down: an email alias or a form that does not create a public issue. Do not use the issue tracker for an unfixed finding.
• Add SECURITY.md at the repository root with: supported versions, what to include in a report, how the report is acknowledged and triaged, and what the reporter must not do (public disclosure before a fix, testing against an instance they do not own).
• Link it from README.md, CONTRIBUTING.md, and the docs index, and decide whether the public instance should link it too.
• State the current boundary honestly: artifact signing is #94 and is not done yet; docs/operations.md says what is and is not protected.

Acceptance

• A security report can be sent privately, and the address and process are public.
• SECURITY.md is linked from the README and the contributing guide.
• #106 can point at it for responsible disclosure.

Related: #14, #94, #106.