docs(security): SECURITY.md points the MCP proxy DNS residual at closed #5061

## Why

`SECURITY.md:52` says the resolve-versus-connect DNS-rebinding residual in `api/mcp-proxy.ts` is "tracked in issue #5061". #5061 closed on 2026-07-13 with no comments. The live tracker is the draft advisory GHSA-887j-p88r-qmm9, updated 2026-09-04, the day after #7605 reverted the Node-runtime socket pin.

## State of the residual (verified 2026-09-15)

- `api/mcp-proxy.ts` re-resolves and classifies A and AAAA answers before each fetch, then discards the vetted address. `tests/mcp-proxy.test.mjs`, `tests/mcp-bounded-json.test.mjs`, and `tests/edge-functions.test.mjs` pass (387).
- #7578 and #7591 moved the route to Node and pinned the socket. #7605 reverted both after `FUNCTION_INVOCATION_FAILED` on OPTIONS and GET in production. The cause was never diagnosed. #7605 named two gaps: the live smoke gate only ever skipped, and the preview was never probed.
- `.github/workflows/mcp-live-smoke.yml` now runs `scripts/mcp-live-smoke.mjs` against `worldmonitor.app` and `www.worldmonitor.app` every 15 minutes and on every Production deploy. Four green runs on 2026-09-15. Previews are excluded by design.

## Do

1. Repoint `SECURITY.md:52` at the advisory, or reopen a tracking issue.
2. Before any retry of the Node migration, pull the Vercel invocation logs for the request IDs in #7605 and name the cause. Add a preview probe with a deployment-protection bypass token so the smoke runs before merge, not only after.

A retry today would be detected within 15 minutes by the cron smoke, but not prevented.

Start at SECURITY.md:52 and compare its #5061 reference with GHSA-887j-p88r-qmm. Review api/mcp-proxy.ts, #7605, the Vercel invocation logs, and .github/workflows/mcp-live-smoke.yml with scripts/mcp-live-smoke.mjs; run the listed MCP tests and inspect the existing smoke runs. Done means the documentation points to live tracking and the requested migration evidence and preview-probe work have a decided, documented outcome.

Written by the indexing model from the issue text.