docs(governance): good-first-issue, vuln disclosure, coordinated disc… - #1728

Summary

Closes #1610
Closes #1612
Closes #1616
Closes #1614

All changes are confined to Governance/ (no application code).

#1610 – Good first issue policy

Governance/policies/GOOD_FIRST_ISSUE.md

• Criteria for the label (scope, acceptance criteria, pointers, low risk, mentor available)
• Who may apply / remove the label
• Mentorship expectations (response, first review, no silent takeover, credit)

#1612 – Vulnerability disclosure process

Governance/processes/VULN_DISCLOSURE.md

• Private channels (GitHub Security Advisories, security email)
• Triage steps with acknowledgement target (3 business days)
• Coordinated-disclosure timeline aligned with embargo policy

#1616 – Coordinated disclosure process

Governance/processes/COORDINATED_DISCLOSURE.md

• Coordination steps with reporters
• Public-disclosure timing (fix available vs embargo maximum)
• Credit policy (named, anonymous, duplicates, out-of-scope)

#1614 – Security response team charter

Governance/SECURITY_RESPONSE_TEAM.md

• Membership (Lead, Members, on-call rotator)
• Responsibilities (monitor, triage, fix, embargo, advisory, post-incident)
• Weekly on-call rotation and backup
• Decision authority table

Documentation

Governance/CHANGELOG.md — Unreleased entries for all four documents.

Test plan

• No code outside Governance/
• Cross-links to existing SECURITY_POLICY.md, EMBARGO.md, LABEL_TAXONOMY.md, ON_CALL.md
• Style matches existing governance headers (Status / Version / Owner / Last reviewed)