docs: give security reports a channel that works, and gate it (#9)

[devin-ai-integration]

Summary

SECURITY.md offered exactly one way to report a vulnerability — the GitHub advisory page — and that page 403s because private vulnerability reporting is disabled on this repo. Confirmed, not inferred:

$ gh api repos/suboss87/FDEOps/private-vulnerability-reporting
{"enabled":false}

That is how #9 ended up as a public issue from someone holding a finding they could not send anywhere. Fixed so a researcher always has a working path:

• Email ([fdeops security] subject) is the primary channel — it does not depend on a repo setting. Advisories stay listed as the equally-good option when enabled.
• Added what to include, an explicit "no real client material" rule, response-time targets stated as targets, and in/out of scope framed around the guarantees fdeops actually makes (<private> reaching a model/dashboard/hook/MCP/memory file, cross-client leakage, destructive installer/CLI behaviour, a write applied without confirmation, the CLI touching the network).
• New .github/ISSUE_TEMPLATE/config.yml contact link so "New issue" points at SECURITY.md before someone discloses in public.
• check.js now requires SECURITY.md to contain a channel independent of GitHub settings:

if (!/[\w.+-]+@[\w-]+\.[\w.]+/.test(read('SECURITY.md')))
  fail('SECURITY.md must give a reporting channel that works when GitHub private reporting is off')

Still needs you (one toggle, I cannot do it — 403 Resource not accessible by integration): Settings → Code security → Private vulnerability reporting → Enable. The docs are correct either way now; enabling it just makes the better channel live.

78/78 checks + tests pass.

Link to Devin session: https://app.devin.ai/sessions/f135381c4682413bae73dff38eb6d1a3
Requested by: @suboss87

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.