security: add disclosure policy, threat model, and CI audit gate

[mkhalid-s]

Summary

• add a private vulnerability disclosure policy and publish it with the npm package
• document assets, trust boundaries, deployment assumptions, residual risks, and a security-review checklist
• make high-severity dependency auditing an explicit CI gate
• add Worker authentication regression coverage for fail-closed configuration, invalid callers, and secret stripping
• create export artifacts with owner-only permissions on POSIX systems

Validation

• pnpm run audit — no known vulnerabilities
• pnpm test — 923 tests passed
• pnpm run typecheck
• pnpm run build
• npm pack dry-run includes SECURITY.md and docs/SECURITY_MODEL.md
• focused secret scan found no credential-shaped secrets in production source, workflows, scripts, or documentation

The branch was rebased onto current main; dependency and Node telemetry hardening already landed upstream were deliberately removed from this PR to avoid duplication.

[mkhalid-s]

@teamchong This security-hardening PR is rebased onto current main, mergeable, and green (923 local tests plus GitHub CI). It avoids duplicating the dependency and telemetry fixes already landed upstream. Ready for maintainer review when convenient.