fix: move security policy to .github/SECURITY.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Neo

.github/SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in 0pnMatrx, do not open a public GitHub issue.
+
+Email: security@openmatrix.io
+
+Include:
+- A description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Any suggested fix
+
+You will receive a response within 72 hours. We take all security reports seriously.
+
+## Scope
+
+The open source runtime in this repository is in scope. The closed-source security layer (Matrix) is out of scope for public disclosure.
+
+## Responsible Disclosure
+
+We ask for a 90-day responsible disclosure window before any public publication of a discovered vulnerability.