docs(security): update disclosure contacts and reporting requirements

[alchemydc]

Motivation

Two problems with SECURITY.md.

Reports arrive untested against current code. Triage time is wasted when a
vulnerability report's proof of concept was never tested against a current
version of Zebra. SECURITY.md did not tell reporters which version to test
against, or to say which version they tested.

The published contacts had gaps. A review of the contacts turned up three
issues:

• pilizcash.01 was the only handle on the Signal channel for critical
  vulnerabilities. If that person is unavailable, a consensus-split or
  counterfeiting report has no fast path in.
• The PGP block contained two concatenated primary keys. E7B32440DA784EBFB8AA2845FD6D55591BF92BCA
  (Zcash Foundation <security@zfnd.org>, created 2026-01-29) is self-revoked
  and expired on 2026-02-28; only 7550C36C3DF616A69F1EFE006046DDEF94CF99B5
  (Zcash Foundation Security Team, expires 2028-03-03) is live. Both were
  published together in docs: Update SECURITY.md with public encryption key #10460. A reporter importing the block could encrypt
  to the dead key, or read the revocation and conclude the ZF key is gone.
• The bilateral disclosure agreement with Shielded Labs was not listed.

Solution

Add a "Before You Report" subsection at the top of "Receiving Disclosures" in
SECURITY.md, before the reporting-channel instructions. It asks reporters to:

• confirm the issue affects the latest Zebra release or the current main
  branch before submitting,
• test any proof of concept against one of those two versions,
• state the exact release version or main commit hash tested in the report.

Also add a "Security Vulnerability Reports" section to AGENTS.md (which
CLAUDE.md symlinks to) so AI coding agents hold agent-assisted reports to the
same standard: route suspected vulnerabilities through SECURITY.md instead of
public issues or PRs, reproduce against the latest release or current main,
include the version tested, and don't submit speculative findings without a
reproduction.

Then update the published contacts:

• Add conrado.42 and dc_zf.77 to the Signal list, and state that the group
  must include all of the listed handles rather than any one of them.
• Re-emit the PGP block with only the live 7550C36C… key and its Curve25519
  encryption subkey, and publish that fingerprint in plain text so a reporter
  can verify the armor without importing it first.
• Add Shielded Labs to the bilateral responsible disclosure agreement list.

The Signal handles here are deliberately ZF-side only. The ecosystem policy at
zcash/.github/SECURITY.md lists dairaemma.31, pilizcash.01, and
nuttycom.01; this document aligns with that process rather than duplicating
its contacts.

Tests

Documentation-only change; verified markdown heading structure renders
correctly.

The re-emitted key block was verified two ways, since a broken armor block
would silently take the email fallback channel offline:

1. OpenPGP packet walk over the edited file — exactly one primary key, v4
   fingerprint 7550C36C3DF616A69F1EFE006046DDEF94CF99B5, one encryption
   subkey, no revocation signature, recomputed CRC24 matching the =K4Oq
   armor checksum.
2. gpg round-trip in a throwaway homedir — imports as a single non-revoked
   ed25519 [SC] + cv25519 [E] pair expiring 2028-03-03, and
   gpg -e -r security@zfnd.org succeeds against subkey E9AE3777E154032C,
   confirming the key is actually usable for encryption.

markdownlint passes with .trunk/configs/.markdownlint.yaml. codespell
was not run locally (not installed on this host); CI covers it.

AI Disclosure

• No AI tools were used in this PR
• AI tools were used: Claude Code drafted the SECURITY.md wording and PR
  description, and audited the published PGP key block and contacts.

PR Checklist

• The PR title follows conventional commits format: type(scope): description
• The PR follows the contribution guidelines.
• This change was discussed in an issue or with the team beforehand.
• The solution is tested.
• The documentation and changelogs are up to date.

[conradoplg]

I checked the gpg pubkey matches the one I have

[mergify]

Queued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-05 16:14 UTC · Rule: batched · triggered by rule move to any queue if GitHub Rulesets are satisfied
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-08-05 16:15 UTC · at 53a47b744f5dd4bc8d56e2365c420139ee84cd45 · merge

This pull request spent 58 seconds in the queue, including 12 seconds running CI.

Required conditions to merge

• #review-threads-unresolved = 0 [🛡 GitHub repository ruleset rule PR Requirements]
  • docs(security): update disclosure contacts and reporting requirements #11174
• github-review-approved [🛡 GitHub branch protection]
  • docs(security): update disclosure contacts and reporting requirements #11174
• github-review-approved [🛡 GitHub repository ruleset rule PR Requirements]
  • docs(security): update disclosure contacts and reporting requirements #11174
• any of [🛡 GitHub repository ruleset rule PR Requirements]:
  • check-success = @github-actions/lint
  • check-neutral = @github-actions/lint
  • check-skipped = @github-actions/lint
• any of [🛡 GitHub repository ruleset rule PR Requirements]:
  • check-success = test-crates
  • check-neutral = test-crates
  • check-skipped = test-crates
• any of [🛡 GitHub repository ruleset rule PR Requirements]:
  • check-success = unit-tests
  • check-neutral = unit-tests
  • check-skipped = unit-tests
• any of [🛡 GitHub repository ruleset rule PR Requirements]:
  • check-success = @github-actions/pr-gate-result
  • check-neutral = @github-actions/pr-gate-result
  • check-skipped = @github-actions/pr-gate-result