Ensure GitProxy adheres to OSPS Baseline Level 3

I scanned GitProxy using AI based on the [most recent OSPS Baseline criteria](https://baseline.openssf.org/versions/2026-02-19). Fortunately, the project adheres completely to Level 1, and mostly hits all the notes on Level 2 (the "MUST" criteria).

Here are the missing criteria, all of them from Level 3 (note that I excluded false positives):

### Level 3
- OSPS-DO-03.01 — No consumer instructions to verify integrity or authenticity of release assets.
- OSPS-DO-03.02 — No instructions to verify the identity of the person or process that authored a release.
- OSPS-DO-05.01 — No statement of when a release line stops receiving security updates.
- OSPS-QA-02.02 — Releases are not shipped with an SBOM (no CycloneDX/SPDX generation in release workflows).
- OSPS-SA-03.02 — No threat model or attack-surface analysis document.
- OSPS-VM-04.02 — No VEX documents for dependency vulnerabilities that do not affect GitProxy.
- OSPS-VM-05.01 — No documented SCA remediation threshold (tools encode fail-on-severity: high, but that is not a project policy).
- OSPS-VM-05.02 — No documented policy that SCA violations must be addressed before a release.
- OSPS-VM-06.01 — No documented SAST remediation threshold.
- OSPS-QA-04.02 is N/A: GitProxy is a single public source repository (a monorepo that also contains the CLI, website, plugins, and experimental license-inventory). There is no multi-repo release surface to hold to a stricter bar.

**Describe the solution you'd like**
Fix up our release and security documentation so GitProxy is compliant with all Level 3 criteria.

Start by reviewing the release workflows and existing release and security documentation against the listed OSPS Level 3 criteria. Identify how releases are built and documented, including SBOM generation and vulnerability policies. Done means the applicable criteria are addressed, with OSPS-QA-04.02 documented as N/A and the requested integrity, support, threat-model, VEX, SCA, and SAST guidance in place.

Written by the indexing model from the issue text.