Vulnerability disclosure policy with contact address and canonical Forgejo URL, per org-wide AAA+ C-axis (trust) rollout.