docs: expand vulnerability disclosure policy

[ccai40359-wq]

Summary

• Replaces public-issue vulnerability reporting guidance with private reporting channels.
• Documents response targets, scope, safe harbor, coordinated disclosure, and reward expectations.

Verification

• Content assertions for required policy sections passed.
• git diff --check passed.
• Added-line security scan found 0 findings.
• Independent reviewer found no security or logic blockers.

Closes #84