Summary

• Sync SECURITY.md with the published v0.2.0 GitHub Release state.
• Replace stale 0.1.x/pre-release support language with current 0.2.x best-effort support language.
• Document that private vulnerability reporting is currently verified as disabled.
• Keep PyPI explicitly marked as not published.

Validation

• ./scripts/check.sh
• git diff --check
• staged review
• stale SECURITY grep checks
• stale global release-state grep checks

Scope

Only SECURITY.md is updated.

No README, CHANGELOG, pyproject, code, tests, CI, tag, release, assets, or PyPI changes.