Docs: SECURITY.md + threat model (responsible disclosure)

[noeljackson]

Why

deepsec is a security tool. Shipping a security tool without a responsible-disclosure policy is unserious signalling and a real risk: if someone finds a bypass or a vuln in deepsec itself, they have no clear channel.

What it should cover

• Reporting channel: a private security email (or GitHub Security Advisories) for vulnerabilities in deepsec itself, the bundled matcher pack, or any first-party plugin.
• Scope: in-scope (CLI, matcher engine, AI backends, agent loops, compliance reporter, AST bridge) and out-of-scope (vulnerabilities found by deepsec in user code — not deepsec's problem).
• SLAs: acknowledge within N days, triage within M days, disclosure timeline.
• Threat model as a short section: who's the attacker (malicious matcher pack? compromised provider key? hostile target codebase?), what's the asset (user findings, API keys, the scanner's own state).
• PGP key / Signal handle if needed for sensitive reports.

Acceptance

• SECURITY.md at repo root, linked from README.
• Threat model summary in docs/threat-model.md (one page).
• A bug-bounty label (no money attached for v0) for tracking disclosed issues.