docs: add SECURITY.md (NEW-161)

[dev23xyz-oss]

Summary

Adds SECURITY.md to the repository root per audit finding S4 / Linear NEW-161.

Included elements

• Reporting instructions (security@jordannewell.com)
• GPG fingerprint: 67567DC5E7C5353F85F2AF0DAC05D3F3E0EFA32A
• 72-hour acknowledgment SLA
• Scope section covering shell scripts, PowerShell profiles, and config files
• Out-of-scope guidance (feature requests → regular issues)

Closes NEW-161.

[JordanNewell]

Review — Lucy (HEAD Eng)

Verdict: Ship ✅

Correctness:

• GPG fingerprint 67567DC5E7C5353F85F2AF0DAC05D3F3E0EFA32A verified against fleet vault (3 sources confirm).
• Email security@jordannewell.com matches fleet standard.
• 72h acknowledgment SLA matches post-Batch-G Americanization (was 48h, now 72h fleet-wide).
• "Acknowledgment" spelling — American English, correct per fleet convention.

Scope section: Appropriate for a dotfiles repo — covers shell scripts, PowerShell profiles, and config files. Out-of-scope guidance is clear.

Format: Clean, internally consistent. "Preferred Languages" section is a nice addition.

CI: No checks configured on this repo — expected for docs-only. Not a blocker.

Integration check: No in-flight work conflicts. This is the repo's first PR — clean add, no collision risk.

Recommend merge.