docs: one way in for an agent, and one address for a vulnerability

D-census 20/21.08 measured llms.txt missing in 23 of 23 org repos, and this
repo among four naming hello@ as its security contact. Two operator decisions
from 21.08 land here.

llms.txt: the reader is an AI agent already standing in the repo, not a
crawler (GPTBot/ClaudeBot/Google-Extended skip /llms.txt in practice, so that
is never the argument). The README carries three code blocks; the entrance is
the first one, and nothing in the file says so. llms.txt names it and quotes
that block byte-for-byte -- sha256 of README:45-48 equals sha256 of
llms.txt:13-16, so a rewritten variant cannot drift in unnoticed. Kept minimal:
H1, one blockquote, the command, two link sections. All 9 link targets verified
to exist on disk. llms.txt is a convention, not a ratified standard (a June 2026
W3C proposal makes four substantive changes, which four is NOT verified here) --
another reason to keep it small.

SECURITY.md: hello@ works and is not a dead address; the defect is that a
reporter comparing two repos from the same org sees two addresses and has to
guess which one is the security channel. security@ is the designated one and
the operator confirmed it works. Only the security contact moved. hello@ stays
in CODE_OF_CONDUCT.md, where it is correct.

shared/SECURITY.md carries the same hello@, but shared/ is a pull-only subtree
of portfolio-optimiser-commons -- untouched here, reported to its owner instead.

923 tests still green. No version bump, no tag, no publish.

Order: 20260821T041218Z-8541228824-from-.claude

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PmgNBXGNpDvUALdGBBhiK8

SECURITY.md

@@ -8,7 +8,7 @@ We take security seriously. If you discover a security vulnerability, please rep
 
 ### How to Report
 
-Email: hello@fromaitochitta.com
+Email: security@fromaitochitta.com
 
 Include:
 - Description of the vulnerability