docs: correct the supported-version table and pin the hand-maintained bumps

[bernardladenthin]

Summary

Two documentation defects a release-readiness audit surfaced. Both would have shipped with the 1.2.0 tag.

• SECURITY.md claimed no release exists. It still said "The project has not yet cut a versioned release" and listed 0.1.0-SNAPSHOT as the only supported version — five releases after 1.0.0, with 1.0.0 … 1.1.1 all resolvable on Central. A reporter reading it would conclude no released version is in scope. The table now names the current release line, states that older lines are not patched retroactively, and says why upgrading within a line costs nothing but a version bump: the three artifacts are released together from one parent pom at a single version.

• The runbook never said what versions:set does not touch. That is why the above went stale. docs/RELEASE.md step 1 now enumerates every hand-maintained version literal — both READMEs, CLAUDE.md, SECURITY.md, the CHANGELOG.md heading and its two link refs — with the grep that finds what was missed, to be run before the tag rather than after.

Test plan

Documentation only; no code or build change.

• The claim was verified, not assumed: net.ladenthin:srcmorph{,-cli,-maven-plugin} and srcmorph-parent all return HTTP 200 at 1.1.1 on Central and 404 at 1.2.0, so "no versioned release" was factually wrong and 1.2.0 is free to publish
• grep -rn "1\.1\.1" --include="*.md" . — the remaining hits are deliberate historical references (the retired relocation stub, the llamaLibraryPath removal note, "last released version"), not stale snippets
• CI is green on this branch

Related issues / PRs

Follows #194 and #195; prepares the v1.2.0 tag.

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes — this edits the security policy text, not any security-relevant code path

---

Generated by Claude Code

[claude]

Review feedback

Issue 1: Outdated package reference in SECURITY.md

The Scope section still references the old, renamed plugin package path:

src/main/java/net/ladenthin/maven/llamacpp/aiindex/**

Per CLAUDE.md, the package was renamed to net.ladenthin.maven.srcmorph.mojo as part of the 3-module reactor migration. Since this PR is already updating SECURITY.md, this should be corrected to:

src/main/java/net/ladenthin/maven/srcmorph/mojo/**

Issue 2: Unclear grep pattern in docs/RELEASE.md

The grep command uses <previous version> as a literal pattern:

grep -rn "<previous version>" --include="*.md" .

This won't find actual version occurrences. Users need clear guidance on what to substitute. Consider clarifying like:

grep -rn "X.Y.Z" --include="*.md" .  # where X.Y.Z is the old version being replaced

Or provide a concrete example (e.g., when upgrading from 1.1.1 to 1.2.0).

---

Otherwise, the documentation improvements are solid and address the real issue of stale version references. The SECURITY.md table is accurate and the RELEASE.md runbook additions provide valuable guidance for future releases.

[claude]

The grep pattern needs to be more specific. <previous version> as written won't match actual version literals. Users need guidance on what to substitute. Consider:

Suggested change

	`grep -rn "<previous version>" --include="*.md" .` finds what was missed; run it before tagging,
	`grep -rn "1.1.1" --include="*.md" .` (replace with the old version being bumped from) finds what was missed; run it before tagging,

Or provide a clearer instruction explaining that users should substitute the old version number.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud