[codex] Add security-sensitive bootstrap mode

[stackbilt-admin]

Summary

Adds the security-sensitive bootstrap path requested in #100.

Changes

• Adds charter bootstrap --security-sensitive support, wired through the existing setup phase.
• Generates a repo-root SECURITY.md responsible disclosure template.
• Seeds .charter/patterns/security-deny.json with hard-fail deny patterns for timing-sensitive comparisons, optional security binding access, security TODOs, and token JSON exposure.
• Makes charter drift load security-deny.json separately and report matches as BLOCKER violations that fail CI regardless of drift score.
• Adds a charter doctor warning for opted-in repos that do not have a security* or l4* test file.
• Documents the flag in README and CLI reference.

Verification

• pnpm exec vitest run packages/cli/src/__tests__/bootstrap.test.ts
• pnpm run typecheck
• pnpm exec vitest run packages/cli/src/__tests__ with elevated permissions for git-based fixture tests: 17 files / 91 tests passed

Addresses #100

[stackbilt-admin]

Superseded by #141 (consolidated branch: codex/consolidate-pre-repo-work). Closing this PR in favor of the combined review.