## Summary

Describe the change and why it is needed.

## Validation

- [ ] I ran the relevant local checks, or this change only affects docs/policy files.
- [ ] I updated docs or policy files when the public contract changed.

## Risk review

- [ ] This change does not add credentials, private infrastructure details, or sensitive sample data.
- [ ] This change is not a public security report. If it is security-sensitive, I used the process in `SECURITY.md` instead.

## Follow-up

List any follow-up work that still needs tracking.
