docs(security): add SECURITY.md and private-reporting checklist (Task 06)

- Add root SECURITY.md: supported versions (0.7.x), private reporting via
  GitHub's "Report a vulnerability", best-effort response expectations,
  coordinated disclosure, and no-secret guidance.
- Add private-vulnerability-reporting checklist that separates repository
  file work (this PR) from GitHub settings changes that require their own
  approval (Task 07: enabling private vulnerability reporting).

No external links to validate; the reporting path uses the repo Security
tab. SECURITY.md documents the private reporting path ahead of Task 07
enabling it.

SECURITY.md

@@ -0,0 +1,58 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are provided for the latest released minor version. Older
+versions are not maintained; please upgrade before reporting.
+
+| Version | Supported |
+|---------|-----------|
+| 0.7.x   | ✅        |
+| < 0.7   | ❌        |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues,
+pull requests, or discussions.**
+
+Report vulnerabilities privately through GitHub's built-in private vulnerability
+reporting:
+
+1. Go to the repository's **Security** tab.
+2. Select **Report a vulnerability**.
+3. Provide a clear description, affected versions, reproduction steps, and
+   potential impact.
+
+This opens a private advisory visible only to the maintainers and to you.
+
+### What to include
+
+- The affected component and version.
+- Steps to reproduce, or a proof of concept.
+- The impact you believe the issue has.
+
+### What not to include
+
+- **Do not include real secrets, credentials, API keys, or access tokens** in
+  your report. If a secret has been exposed, say so and rotate it — do not paste
+  its value.
+
+## Response Expectations
+
+This project is maintained on a **best-effort basis**. Reports are reviewed and
+addressed as maintainer availability allows; there is no guaranteed response
+time. We will engage with the private advisory as we triage and work on a fix.
+
+## Coordinated Disclosure
+
+We follow coordinated disclosure. Please give the maintainers a reasonable
+opportunity to investigate and release a fix before disclosing the issue
+publicly. We will coordinate the timing and content of any public disclosure
+with you through the private advisory.
+
+## Scope
+
+This policy covers the code in this repository. Vulnerabilities in third-party
+dependencies should be reported to the respective upstream projects; if a
+dependency issue affects this project specifically, you may still report it here
+so we can track remediation.

docs/maintenance/repository-recovery/private-vulnerability-reporting-checklist.md

@@ -0,0 +1,40 @@
+# Private Vulnerability Reporting — Setup Checklist
+
+_Repository-recovery Tasks 06–07. This checklist separates repository-file work
+(committable in a PR) from GitHub repository-settings work (changes live GitHub
+state and requires its own explicit approval)._
+
+## Part A — Repository files (Task 06, this PR)
+
+- [x] Publish `SECURITY.md` at the repository root with:
+  - [x] Supported versions.
+  - [x] Private reporting path (GitHub "Report a vulnerability").
+  - [x] Response expectations (best-effort).
+  - [x] Coordinated disclosure policy.
+  - [x] No-secret guidance.
+- [x] Publish this checklist.
+
+These are file changes only. They do **not** enable the private reporting
+feature — they document how to use it once enabled.
+
+## Part B — GitHub repository settings (Task 07, separate approval)
+
+> ⚠️ The following change live GitHub state, not files. Each requires explicit
+> approval immediately before it is made, and is verified by read-back.
+
+- [ ] Enable **Private vulnerability reporting**
+  - Settings → Code security and analysis → Private vulnerability reporting → Enable.
+  - API: `PUT /repos/{owner}/{repo}/private-vulnerability-reporting`.
+  - Read-back: `GET /repos/{owner}/{repo}/private-vulnerability-reporting` shows `enabled: true`.
+- [ ] Confirm the **Security** tab now offers "Report a vulnerability" so the
+      path documented in `SECURITY.md` is live.
+- [ ] Record evidence in
+      `docs/maintenance/repository-recovery/private-vulnerability-reporting-evidence.md`.
+
+## Notes
+
+- `SECURITY.md` references the private reporting path before Part B is applied.
+  There is a brief window where the documented path is not yet live; Part B
+  should follow promptly.
+- No other repository setting is changed as part of Part B — only private
+  vulnerability reporting.