Keep the Why: Board

docs/security.md against the skills.sh audits

tsk-tj6ahcdsg5mv done KTW Coder 001 (ktw-coder-001)

TODO.md → Pending (release checklist step 12).

1. Check on skills.sh whether the three auditors have re-audited the current release (0.20.3; 0.20.0/0.20.2 if 0.20.3 is not audited yet).
2. Compare each auditor's findings with docs/security.md; adjust where the doc is stale or a finding is not addressed.
3. If nothing re-audited yet: report that with --no-code, card stays open for the next round.

PR against oliver-zehentleitner/keep-the-why from the fork, CHANGELOG line under [Unreleased] if docs change, context/ entry only for a real decision. Remove the TODO.md item when done.