Publish security policy and runtime threat model (#70)

[codeforester]

Summary

• publish SECURITY.md with private reporting, supported versions, response targets, and coordinated disclosure
• add a runtime threat model covering secrets, filesystem ownership, plugins, concurrency, inherited runs, and telemetry
• add a threat-to-control release checklist, documentation guards, and release-manifest wiring

Why

Professional CLI adopters need to understand what the lifecycle protects, where consumer trust begins, and how to report a vulnerability. The new policy makes those boundaries explicit and maps every requested threat area to existing controls and regression suites.

Closes #70

Validation

• ./tests/validate.sh
• uv run --extra dev --extra typer --extra quality python -m pytest -q
• ruff format --check scripts examples
• ruff check lib/python/base_cli scripts examples tests
• python -m mypy --strict examples/typed_consumer.py
• python scripts/validate_docs.py
• python scripts/benchmark_runtime.py --check
• bandit -q -r lib/python/base_cli scripts -lll -iii
• pip-audit --strict
• package build and sdist inspection confirmed SECURITY.md and both security docs are included