chore(security): fill the security-contact placeholders (owner-supplied values) - #33

…ed values)

Fills the 13 {{PLACEHOLDER}} tokens that kept openssf-compliance red, with
values ruled by the owner on 2026-07-27/28:

  SECURITY_EMAIL   security@metadatastician.art
  PGP_KEY_URL      https://metadatastician.art/.well-known/pgp-key.txt
  PGP_FINGERPRINT  ABF3ECD932C2A04345EC9B3D2E725C6B831EA2B8
                   (ed25519, created 2026-07-28, expires 2027-07-28,
                    verified from the owner's exported public key)
  WEBSITE          metadatastician.art

Judgement calls, recorded:
- The TEMPLATE INSTRUCTIONS comment block is deleted (its own text says to
  delete it before publishing, and it contained literal {{...}} tokens that
  would keep the gate red).
- The two gpg example commands were keyed on the SECURITY EMAIL; the key's
  UID is jonathan@metadatastician.art, so 'gpg --fingerprint security@...'
  and '--recipient security@...' would fail. Both now key on the FINGERPRINT,
  which works regardless of UID.
- security.txt's optional 'Hiring:' line is dropped rather than filled — no
  /careers page exists, and RFC 9116 marks the field optional. Shipping a
  dead link helps nobody.

The key itself is being published at the PGP_KEY_URL via the estate-wellknown
Cloudflare worker (which generates /.well-known/security.txt dynamically for
the estate domains); until that deploy lands the URL 404s — the repo files
are correct either way.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>