docs(security): prefer private vulnerability reports

[ss-o]

Problem

z-shell/zi#315 reports a missing repository security policy. Zi already inherits the organization policy from this repository, so adding a second Zi-local copy would create policy drift. The inherited policy still routes reporters to generic organization contacts instead of the enabled private vulnerability-reporting flow.

Approach

• make the affected repository's private Report a vulnerability flow the primary intake path
• keep organization-profile private contacts as the fallback
• explicitly prohibit vulnerability details in public issues, pull requests, or discussions
• retain coordinated-disclosure and reporter-credit expectations
• link maintainers to the canonical incident-response runbook

Verification

• python3 scripts/validate-agent-policy.py
• python3 -m unittest scripts/test_validate_agent_policy.py -v — 75 passed
• npx --yes markdownlint-cli2 .github/SECURITY.md — 0 issues
• lychee .github/SECURITY.md — 2 links checked, 0 errors
• actionlint .github/workflows/*.yml
• git diff --check
• confirmed z-shell/zi/security/policy currently inherits this organization file
• confirmed private vulnerability reporting is enabled for z-shell/zi

Scope and risk

This updates the single organization-level reporter policy; it does not add per-repository copies, change repository settings, or alter the internal incident-response process.

Closes z-shell/zi#315