docs: publish active security reporting path - #14

Summary

• document the now-enabled private vulnerability reporting path for SagaSmithAI
• record the repository-level secret scanning, push protection, and Dependabot settings
• retain a private email fallback only when GitHub does not expose the reporting flow

Validation

• git diff --check
• verified through GitHub API that all nine active non-archived, non-fork SagaSmithAI repositories have private vulnerability reporting, secret scanning, push protection, and Dependabot security updates enabled

Related to #8