docs: publish Tend Compose continuity evidence

Export the reviewed allowlisted snapshot from private source commit 07c1655921f21ee5e4fc4d85639d199e8867b17d. This records the Docker Compose activation, schema-compatible rollback, and stateful migration resource findings from Observatory Preview 19 dogfooding.

AI-Assisted: OpenAI Codex
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

SECURITY.md

@@ -0,0 +1,17 @@
+# Security policy
+
+Report suspected vulnerabilities privately to `security@sandwichhime.com`.
+Please include the affected Tend version, configuration shape, reproduction,
+and expected impact. Do not include production credentials or private logs.
+
+Tend treats reviewed source, pinned toolchains, root-owned server policy and
+configuration, handwritten Caddy templates, and operators as trusted. It treats
+requested service names, protocol frames, artifact paths and bytes, archives,
+filesystem state, process output, HTTP responses, and deployment targets as
+adversarial inputs. It never evaluates configuration as shell code.
+
+The preview is not a sandbox and does not make an untrusted repository safe to
+build. Run `tend package` only for reviewed source. Production configuration,
+receive policy, host keys, identities, and `0600` environment files stay outside
+repositories. A secret value appearing in a Tend report, artifact, state file,
+or process argument is a security defect and should be reported.