SECURITY.md is missing from v2/main — the next milestone merge will drop it from main again #1864

Follow-up to #1843 / #1850.

The gap

SECURITY.md was restored to main in #1843, but it was never added to v2/main.

Since v2/main is the develop branch that gets merged into main at milestone releases — and the two share no common git ancestor (git merge-base main v2/main returns nothing; the v2 tree swap created unrelated histories) — the next milestone merge re-swaps the tree and silently removes SECURITY.md from the default branch a second time.

This is the exact regression #1843 fixed, primed to recur.

Verification

$ git ls-tree --name-only origin/v2/main SECURITY.md
(empty)

$ git ls-tree --name-only origin/main SECURITY.md
SECURITY.md

The fix

Copy SECURITY.md from main to v2/main byte-for-byte (sha256 bbc8aaa5a33d481f902c1b7ac260a4c9c0d41dac5bb2916607222dd205dda924, 2633 bytes). No content changes — the file already describes the v2 packaging model, since #1843 wrote it for the post-swap world.

Related

#1851 applies the same reasoning to .github/workflows/claude.yml: it now targets v2/main rather than main, so it survives the next swap.

Anything else restored directly to main after the swap is suspect for the same reason and is worth a sweep.