Fifth and final PR of the security genericization series.

Lifts the remaining 4 docs in docs/security/ to read config knobs
from projects/_template/project.md and the contract docs from
PR1-PR4 (cve_authority.*, governance.*, security_inbox.*,
forwarders.*, archive_system.*, scope_detection.*). Plus a final
scrub of 4 skills for leftover ASF/Vulnogram literals.

Byte-equivalent for the airflow-s adopter: every ASF/Airflow/
Vulnogram-specific value either resolves through a config knob
whose ASF default matches today's behaviour, OR stays as one
named-example aside in generic prose.

Per-target lifts:

- docs/security/threat-model.md (+107/-77) — Purpose/Scope/
  Assumptions reframed from "ASF"/"PMC" to governance-knob
  terms. STRIDE matrix rows A.6/A.7/C.1-C.4/E.1-E.2 lifted:
  Vulnogram -> <cve-tool>; security@apache.org -> <security-list>;
  DRAFT/REVIEW/READY/PUBLIC -> cve_authority.states sequence
  (allocated -> review-ready -> publish-ready -> public).
  Mitigations M.10/M.16/M.18/M.19/M.27 + residual risks
  #3/#8/#10/#11 + re-audit cadence ownership generalised.

- docs/security/forwarder-routing-policy.md (+42/-27) — references
  the optional security-issue-import-via-forwarder sub-skill from
  PR3 (#387) and the tools/forwarder-relay/README.md contract.
  Replaces "ASF-security relay" / "security@apache.org" with
  forwarders.enabled / <security-list> / foundation_security_address.
  ASF-Airflow shown as a named-example aside per concept.

- docs/security/how-to-fix-a-security-issue.md (+20/-8) —
  "governance-authorised member of the adopting project (per
  governance.cve_allocation_gate)" replaces "PMC member of
  apache/airflow"; <cve-tool> + cve_authority.* replaces Vulnogram-
  specific URLs and state names; archive_system.advisory_publication_signal_url
  replaces the lists.apache.org users-list URL.

- docs/security/new-members-onboarding.md (+26/-13) — onboarding-
  style register preserved. "PMC members and committers" reframed
  as "governance body that satisfies governance.cve_allocation_gate";
  per-user-config "PMC status" steps reference the governance knob;
  Vulnogram steps reference <cve-tool> via cve_authority.record_url_template.

- Final scrub of 4 skills (+17/-15 net): security-issue-import,
  security-issue-import-via-forwarder, security-issue-invalidate,
  security-issue-fix — leftover literal references caught and
  lifted to roster.bare_name_handles / governance.escalation_contact /
  forwarders.<adapter>.contact_handle.

Aggregate: 8 files, +240/-156 lines.

That closes the series. Five PRs (#381, #386, #387, #388, this)
transitioned the security skill family from Airflow/ASF-coupled to a
generic framework with ASF as the default-configured option. The
airflow-s adopter, with the ASF defaults baked into project.md, sees
byte-equivalent behaviour throughout. Non-ASF adopters override
specific dimensions (CVE authority, mail provider, archive system,
governance gate, scope axis) by changing only their <project-config>/
files.

Generated-by: Claude Code (Opus 4.7)

…ls (#651)

* feat(validator): add adapter authoring smoke check for contract:* tools

Add a SOFT advisory check (aspect #11) to skill-and-tool-validator that
verifies every contract:* adapter tool README declares the three authoring
fields the adapter contract requires: credential/privacy handling,
supported operations, and adopter config keys.

All three checks are SOFT so legacy adapters can be brought into
compliance deliberately without blocking unrelated changes. Twelve
advisories fire on the current tree; exit code stays 0. New
TestValidateAdapterAuthoring class adds 13 targeted tests.

Generated-by: Claude (Opus 4.7)

* fix two false positives and add to implmentation plan

Add validate_modes_doc_consistency (SOFT, category modes-doc-consistency)
to the skill-and-tool-validator. The check compares docs/modes.md against
live skills/*/SKILL.md frontmatter across four dimensions:

1. Listed skill missing from disk — row exists in modes.md but
   skills/<slug>/ does not.
2. Mode mismatch — a skill's mode: frontmatter differs from the section
   it appears in (e.g. listed under Triage but mode: Mentoring).
3. Skill count mismatch — the integer in "Modes at a glance" Skill count
   column does not equal the actual row count in that mode's section.
4. Unlisted skill — a live skill has a valid mode: frontmatter value but
   is absent from the corresponding docs/modes.md section.

On the live tree the check surfaces two real gaps:
- reviewer-routing has mode: Triage but is absent from docs/modes.md
- good-first-issue-sweep has mode: Mentoring but is absent from docs/modes.md

Ships 19 tests in TestParseModesDocs + TestValidateModeDocConsistency;
all 283 validator tests pass.

Generated-by: Claude (Opus 4.7)

Add validate_modes_doc_consistency (SOFT, category modes-doc-consistency)
to the skill-and-tool-validator. The check compares docs/modes.md against
live skills/*/SKILL.md frontmatter across four dimensions:

1. Listed skill missing from disk — row exists in modes.md but
   skills/<slug>/ does not.
2. Mode mismatch — a skill's mode: frontmatter differs from the section
   it appears in (e.g. listed under Triage but mode: Mentoring).
3. Skill count mismatch — the integer in "Modes at a glance" Skill count
   column does not equal the actual row count in that mode's section.
4. Unlisted skill — a live skill has a valid mode: frontmatter value but
   is absent from the corresponding docs/modes.md section.

On the live tree the check surfaces two real gaps:
- reviewer-routing has mode: Triage but is absent from docs/modes.md
- good-first-issue-sweep has mode: Mentoring but is absent from docs/modes.md

Ships 19 tests in TestParseModesDocs + TestValidateModeDocConsistency;
all 283 validator tests pass.

Generated-by: Claude (Opus 4.7)