Security overview

This section is reserved for generated security scan reports and remediation notes. The repository remains the source of truth for dependency and policy decisions; generated scans belong in the static reporting layer.