feat(bootstrap): security-sensitive preset — L4 scaffold gate + SECURITY.md generation

[stackbilt-admin]

Context

During a CodeBeast audit + remediation of stackbilt-engine (a scaffold code factory), we ran charter bootstrap --preset worker as part of post-hardening governance onboarding. The bootstrap succeeded cleanly (doctor PASS, 12/12), but the experience surfaced a gap: charter's presets don't differentiate repos by security posture.

stackbilt-engine is an EGRESS-class repo — it generates code that ships into every downstream project. A timing attack in its templates (=== on HMAC digests) becomes a hereditary vulnerability. The bootstrap treated it identically to any other worker repo.

Proposal

Add a --security-sensitive flag (or a security preset modifier) to charter bootstrap that:

1. Generates a SECURITY.md from a template (responsible disclosure contact, supported versions table, vulnerability reporting process). This is already tracked as a separate rollout across Stackbilt repos, but charter is the natural place to automate it.

2. Seeds a .charter/patterns/security-deny.json with deny patterns for the drift scanner:

   • === signature / === expected (timing attacks)
   • ?.get() / ?.put() on security-critical bindings (silent bypass)
   • // TODO in auth/session/token paths
   • c.json({ access_token (token exposure)

   These would be consumed by charter drift as hard failures, not warnings.

3. Adds an L4 security gate to verify:adf — a post-bootstrap check that the repo has at least one test file matching **/security* or **/l4*. Emits a warning (not a block) if absent, nudging the team to add security regression tests.

Why charter, not CodeBeast

CodeBeast runs adversarial audits on existing code. Charter governs the development process before code is written. The deny patterns belong in charter's drift scanner because they should prevent regressions at commit time, not catch them after deployment. The two tools are complementary — CodeBeast finds the disease, charter vaccinates against reinfection.

Evidence

• stackbilt-engine audit: 4 CRITICALs + 2 HIGHs (Stackbilt-dev/stackbilt-engine#13-refactor(adf): split bundler into manifest.ts and merger.ts #18), all remediated in same session
• The L4 security test layer we added (tests/security-l4.test.ts, 53 tests) is exactly what the bootstrap security gate would check for
• The deny patterns are directly from the audit findings — they're battle-tested, not hypothetical

Acceptance

• charter bootstrap --preset worker --security-sensitive generates SECURITY.md
• .charter/patterns/security-deny.json seeded with deny patterns
• charter drift treats security-deny matches as errors, not warnings
• charter doctor checks for security test presence (warning-level)
• Documented in README under presets