Step 21c/23 (Phase 6): Docs — Create SECURITY.md + update CONTRIBUTING.md

[Jordan231111]

Summary

Create `SECURITY.md` following GitHub security advisory best practices, and update `docs/contributing-guidelines.md` to match the actual development workflow.

Depends On: None (can be done once workflows are stable)
Parent Issue: #15 (Documentation Completion)

Key Changes

1. Create `SECURITY.md`:
   • Supported versions table
   • Vulnerability reporting process (email or GitHub Security Advisory)
   • Response timeline expectations
   • Security measures in the codebase (no real malware, permission model, checksum verification)
   • Scope: what counts as a vulnerability vs a feature request
2. Update `docs/contributing-guidelines.md`:
   • Development setup: stable Rust toolchain, edition 2024
   • How to run tests (`cargo test`, `./scripts/validate_strict.sh`)
   • PR requirements: tests pass, clippy clean, fmt clean
   • Branch naming conventions
   • Commit message format
   • Code style: idiomatic Rust, error handling patterns
3. Create `docs/RELEASE_CHECKLIST.md`:
   • Pre-release verification steps
   • Version bump procedure
   • Post-release tasks
4. Create `docs/QA_TEST_PLAN.md`:
   • Smoke tests, functional tests, cross-platform validation
   • Performance baselines

Acceptance Criteria

• SECURITY.md follows GitHub security advisory format
• Vulnerability reporting process is clearly described
• CONTRIBUTING.md matches actual dev workflow (stable Rust, edition 2024)
• PR requirements are documented
• RELEASE_CHECKLIST.md covers the full release process
• QA_TEST_PLAN.md provides structured test guidance