docs(security): publish hardening readiness report for findings 8-14

[careb36]

Security Hardening - Readiness Closure Report

What this PR adds

• Formal readiness report for findings chore(repo): clean up stale branches, bootstrap develop, document GitFlow tooling #8 to Develop #14:
  • docs/reports/SECURITY-HARDENING-READINESS.md
• Documentation map update:
  • docs/README.md now includes security reports section

Purpose

Provide a single auditable source of truth for:

• closure status per finding
• implemented evidence references
• residual risk and production condition for Kafka secure enforcement

Outcome

This PR closes the documentation phase of the security hardening stream and enables release-readiness signoff with explicit conditions.

[Copilot]

Pull request overview

Adds an auditable “Security Hardening Readiness Report” documenting closure status and evidence for security findings #8–#14, and links it from the docs index for easier discovery and release signoff.

Changes:

• Introduces SECURITY-HARDENING-READINESS.md summarizing closure status, evidence references, and residual risk/conditions (notably Kafka secure-mode enforcement).
• Updates docs/README.md to include a new “Security Reports” section (EN + ES) linking to the baseline audit and the new readiness report.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
docs/reports/SECURITY-HARDENING-READINESS.md	New readiness/closure report for findings #8–#14 with evidence pointers and release conditions.
docs/README.md	Adds “Security Reports” section to the documentation map (English + Spanish).

[Copilot]

The evidence for finding #8 references the deploy workflow command as mvn --batch-mode clean verify -Powasp, but the current deploy.yml invocation also includes additional required flags (e.g., -DnvdApiKey=...). To keep this report auditable and copy/paste accurate, consider reflecting the full command (or explicitly noting that additional flags are passed via secrets).

Suggested change

	| #8 (deploy pipeline skips tests) | HIGH | Closed | `.github/workflows/deploy.yml` uses `mvn --batch-mode clean verify -Powasp` |
	| #8 (deploy pipeline skips tests) | HIGH | Closed | `.github/workflows/deploy.yml` runs \`mvn --batch-mode clean verify -Powasp\` with additional required flags (e.g., \`-DnvdApiKey\` via secrets) |

[Copilot]

In the Spanish documentation map entry, the description mixes languages ("cierre/readiness"). Consider using a single term (e.g., fully Spanish wording) to keep the index consistent and easier to scan for Spanish readers.

Suggested change

	- `docs/reports/SECURITY-HARDENING-READINESS.md` - estado actual de cierre/readiness para hallazgos #8-#14
	- `docs/reports/SECURITY-HARDENING-READINESS.md` - estado actual de cierre y preparación para hallazgos #8-#14