Summary by cubic

Clarifies the security disclosure policy in SECURITY.md: we will always publish advisories by day 60, prefer to ship fixes before advisories, and update advisories once patches are ready. Removes the milestone table to keep the policy concise and clear.

Description

• Clarifies that advisories publish by day 60 even if a fix is not ready; advisory gets updated once the patch ships.
• States we prefer releasing the fix before the advisory, but will not delay the advisory past day 60.
• Removes the day-by-day milestone table to reduce noise and ambiguity.
• Reasoning: align docs with actual process and set clear expectations for reporters and users.

Docs

• Mirror these changes on the docs site in /docs/ (e.g., the security policy page) to match the updated SECURITY.md.

Testing

• No tests needed; docs-only change.

Semantic version impact

• Patch (docs-only).

^{Written for commit abcc594. Summary will update on new commits.}