Publish a security policy and runtime threat model

[codeforester]

Parent: #50

Train position: 20 of 22
Phase: P3 — Ecosystem trust

Problem

A lifecycle framework that handles argv, configuration, logs, filesystem state, plugins, and telemetry needs a published security contract.

Acceptance criteria

• SECURITY.md documents private reporting, supported versions, response expectations, and coordinated disclosure.
• A threat model covers argv/environment/config/log/history secrets, filesystem/symlink/permissions, plugins, concurrency, inherited runs, and telemetry.
• Trust boundaries, safe defaults, non-goals, and consumer responsibilities are explicit.
• A release/security review checklist maps threats to tests and controls.

Dependencies

• Harden sensitive-option redaction and runtime cleanup boundaries #54
• Implement atomic run bundles and complete-bundle retention policies #62
• Discover extensions through Python entry points #64