Add red-team audit and hardening updates

[Mandal-OS]

Summary

• Add a public red-team review report for the repository and GitHub security posture.
• Expand local secret-pattern scanning coverage.
• Update the security policy language now that private vulnerability reporting is enabled.
• Record the GitHub presentation/security polish in the changelog.

Verification

• npm run check
• npm audit --audit-level=low

Risk Review

• Security: improves local secret scanning and vulnerability reporting guidance.
• Performance: no runtime impact.
• SEO: no public site impact.
• Accessibility: no UI impact.
• Operations: documents current residual risks and next hardening steps.