docs(security): align disclosure policy with TRACE v0.2

[imran-siddique]

Why

SECURITY.md still described this as only a specification/schema repository and listed v0.1 as the current supported version. The public release includes a Python reference library and v0.2-only verification behavior, so reporters need an accurate scope and support statement.

What changed

• put signing and verification APIs, schemas, adapters, examples, packaging, and release automation explicitly in scope
• classify verification bypasses as high-severity implementation findings
• list TRACE v0.2 and agentrust-trace 0.x as supported
• mark TRACE v0.1 and earlier drafts unsupported
• retain GitHub private security advisories as the reporting channel
• add four policy invariants to prevent the release-facing statements from drifting silently

Verification

• focused policy tests: 4 passed
• full suite: 327 passed, 1 skipped
• ruff check src tests
• mypy src/agentrust_trace
• git diff --check