v26.11.2

Added

• A security policy (SECURITY.md) with private vulnerability reporting on GitHub, and a contributing guide
  (CONTRIBUTING.md), now that the repository is public.

Changed

• The release process in Developing devkit uses dev pr merge, dev release, and a check of the published archive.

Fixed

• dev agents test reads the hooks log from the byte offset it recorded, so the guard check no longer reports
  "no guard decision logged" when earlier lines hold multi-byte characters.
• dev ci --run --resume reruns the steps that read every file (secret, filesystem, and docs scans) after a
  docs-only change: a document can leak a key too. Builds and code linters still keep the docs shortcut.
• The Stop hook asks for dev plan revise only for the plans of the project the session works in. With two sessions
  open, it no longer sends one back over a plan the other changed in another project.
• dev doctor compares the installed instructions (~/.claude/CLAUDE.md, ~/.codex/AGENTS.md) and the Codex crew
  roles with what this devkit writes, so an outdated install shows as out of date instead of passing because the
  files exist.
• The installed-plugin check compares the newest copy by version number, so 26.11.10 counts as newer than 26.11.2.