docs: align repository security and contributor guidance - #4962

Summary

The repository's security policy only linked the general disclosure policy, and it had no local contributor guide. Expand SECURITY.md, add CONTRIBUTING.md, and add an agent security checklist in AGENTS.md to cover repository scope, private sanitized reporting, secrets, dependencies, CI, and publishing.

The guidance distinguishes policy requirements from verified operational controls and preserves existing development and release procedures. This change is limited to the three documentation files.

Test plan

• Verify private-reporting, redaction, dependency-cooldown, untrusted-CI, release-approval, publishing-evidence, and scan-status scenarios against the shared security policy and repository configuration.
• Check all 37 local Markdown links and anchors, resolve the root security policy for the SDK, and run git diff --check.
• Complete two consecutive clean adversarial review rounds with two fresh, independent reviewers per round, including security review of the reporting and trust-boundary guidance.
• SDK runtime tests, type checks, and MkDocs builds are not applicable to this repository-guidance-only change.

Issue number

None.

Checks

• Confirmed no new runtime tests are needed for this guidance-only change.
• I've run .agents/skills/code-change-verification/scripts/run.sh — not applicable to repository-meta-only changes under AGENTS.md.
• I've confirmed all applicable local verification steps pass.
• Completed independent adversarial review before submitting this PR.