docs: restore SECURITY.md on v2/main, so the next tree swap can't drop it

[cliffhall]

Closes #1864.

Follow-up to #1843, and the same reasoning that moved #1851 onto v2/main.

The gap

SECURITY.md was restored to main in #1843, but it was never added to v2/main.

v2/main is the develop branch, merged into main at milestone releases — and the two share no common git ancestor (git merge-base main v2/main returns nothing; the v2 tree swap created unrelated histories). So the next milestone merge re-swaps the tree and silently removes the security policy from the default branch a second time.

$ git ls-tree --name-only origin/v2/main SECURITY.md
(empty)

The change

Copied byte-for-byte from main — sha256 bbc8aaa5a33d481f902c1b7ac260a4c9c0d41dac5bb2916607222dd205dda924, 2633 bytes, verified after the copy. No content changes: #1843 already wrote this file for the post-swap world, so it describes the v2 single-package model and the v1-latest dist-tag correctly as-is.

Testing

No source files are touched, so no validate / coverage gate measures this change. npx prettier --check SECURITY.md passes.

Note

.github/workflows/claude.yml (#1851) and this file are the two known instances. Anything else restored directly to main after the swap is suspect for the same reason — a sweep is probably worth doing separately.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

[Copilot]

Pull request overview

Restores the repository’s SECURITY.md on v2/main so that future milestone merges (which effectively swap trees due to unrelated histories) don’t silently drop the security policy from the default branch again.

Changes:

• Add SECURITY.md to v2/main (content matches the restored policy on main).
• Document supported version/package support expectations (v2 single-package vs v1 sub-packages).
• Provide guidance for reporting vulnerabilities via GitHub Security Advisories rather than public channels.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cliffhall]

Superseded by #1867 — same commit, same content.

This PR was auto-closed by GitHub when its head branch was renamed docs/restore-security-md-v2 → v2/docs/restore-security-md-v2 (to satisfy the version-prefix branch convention). GitHub's rename API is documented as updating open PRs, but here it closed this one instead, and it can't be reopened because the original head ref no longer exists. Recreated as #1867 from the renamed branch.

#1867's description also corrects a claim made here: this PR said main and v2/main share no common ancestor. They do — merge base 4d30d1cd, established by the go-live merge (#1830). The earlier finding came from running git merge-base in a shallow clone.