Publishes a vulnerability disclosure policy at the repo root, per the
AAA+ program's C-axis (trust) sweep. Contact address and response
timeline per operator decision; supported-versions section reflects
that the catalog has no versioned release cycle and updates directly
on main.
