security.txt's Contact is a place to report, not a profile: it opens the sealed report form on the forge's own repository #8355

A stranger who finds a hole has one obvious, private place to send it. Today production's /.well-known/security.txt says Contact: <origin>/buster, the first admin's profile page. You cannot send anything private from there, and the sealed-report route the file itself explains is only in a comment.

Done:

• [ ] When FORGE_SECURITY_CONTACT is unset, securityContact (src/web/standards.ts ~line 58) answers the sealed new-issue URL of the forge's own repository (/<own>/issues/new?sealed=1, the repository the changelog calls own), and falls back to the admin profile only when there is none.
• [ ] The file adds Policy: pointing at /llms.txt's reporting section (or the repository's SECURITY.md, if one exists).
• [ ] test/standards.test.ts asserts both lines with and without FORGE_SECURITY_CONTACT.

Files: src/web/standards.ts, test/standards.test.ts. Risk: the sealed form needs an account. If an anonymous visitor would be bounced, also name the token-free report route on the same line's comment.