draft: bug bounty policy (owner to fill)

[SaulBuilds]

Draft bug bounty policy, split out of #7 so #7 can merge now. Do not merge until the owner fills it in and counsel signs off.

BOUNTY.md is marked "DRAFT, not in force". It covers:

• scope: testnet 40204 and in-scope assets
• surfaces that are not deployed or not running (product status only)
• safe harbor
• load limits for shared hosts
• a Known issues placeholder, published per finding once fixed

OWNER TO FILL:

• reward amounts per severity
• launch date, payout method and currency, KYC for payout, eligibility
• a PGP key for security@citrate.ai
• confirm or change the proposed host limits (5 req/s and 10,000 req/day per host)
• counsel review of the safe-harbor text

After merging:

• link BOUNTY.md from SECURITY.md, replacing "Bounty policy: coming soon"
• remove the "not in force" banner

Checks:

• The public-truth lint from security: public-claims accuracy: SECURITY.md, AUDIT_POSTURE, profile + public-truth gate #7 checks this file's structure while it is present. The file is marked not in force, so the lint rejects any link to it.
• Known issues must stay a placeholder.
• The file contains no finding IDs.

Tracking: CitrateNetwork/citrate-security#87.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FYQkdsk54yob6FD24jAT8P