Migrate the public security-report address to perseus.so with monitored compatibility

[samrathchadha]

Source and provenance

SECURITY.md:24 directs vulnerability reports to security@starling.sh, an old-company identity.

Accountable owner

Samrath Chadha owns the security-report channel and must name at least one backup responder.

Acceptance criteria

• Provision security@perseus.so as a restricted security group/queue with MFA-protected members, backup ownership, retention, and an escalation SLA.
• Preserve security@starling.sh as a monitored alias during a documented transition period.
• Test inbound delivery and authorized reply from an external mailbox without including vulnerability details in the test.
• Update SECURITY.md only after the new path works; state the legacy alias and transition date if useful to reporters.
• Add periodic delivery/ownership review and ensure public issue templates continue to redirect exploitable reports away from public issues.

Unresolved conflict

Changing documentation before the new restricted mailbox is operational could silently lose vulnerability reports; old-domain compatibility is required first.