feat: comprehensive vulnerability disclosure program for NOYD PQC ecosystem

[noyddev]

📋 Summary

This PR introduces a complete Vulnerability Disclosure Program (VDP) infrastructure for the NOYD Post-Quantum Cryptography ecosystem. It includes testing tools, documentation, and CI/CD security scanning for ethical hackers and security researchers.

🎯 What This PR Adds

Documentation

• README.md - Landing page with program scope, CVSS v3.1 severity levels, and $100-$25,000 reward structure
• SECURITY.md - Responsible disclosure policy with legally defensive safe harbor clauses covering CFAA compliance
• CODE_OF_CONDUCT.md - Professional community guidelines with research ethics section
• CONTRIBUTING.md - Contribution guidelines for security researchers
• HALL_OF_FAME.md - Researcher recognition leaderboard

Security Testing Tools

Tool	Purpose
tools/fuzz_test.go	go-fuzz harness targeting ML-KEM-768/ML-DSA-65 with CIRCL library
tools/mock_server.go	Lightweight mock NOYD server for local testing
tools/vector_gen.go	Malformed payload generator with 15 mutation strategies
tools/mitm_harness.go	MITM proxy with replay detection and packet tampering
tools/nist_compliance.go	FIPS 203/204 structural compliance validator

Infrastructure

• Dockerfile - Multi-stage build with builder, fuzzer, mock-server, testing-lab
• docker-compose.yml - Complete isolated testing lab with 5 services
• .github/workflows/security-scans.yml - CI/CD with Gosec, Semgrep, CodeQL, and Go Vulncheck
• .github/ISSUE_TEMPLATE/security_bug_report.yml - Structured vulnerability reporting form

Technical Documentation

• docs/memory_sanitizer.md - ASAN/MSAN/UBSan/Valgrind guide
• docs/packet_anatomy.md - Wire protocol deep-dive with byte-level diagrams

🔐 Technical Details

PQC Implementation (Cloudflare CIRCL)

• ML-KEM-768 (FIPS 203): Public Key 1,184 bytes, Ciphertext 1,088 bytes
• ML-DSA-65 (FIPS 204): Public Key 1,952 bytes, Signature 3,309 bytes
• ChaCha20-Poly1305 for session encryption
• HKDF for key derivation

Dependencies

• github.com/cloudflare/circl v1.5.0
• golang.org/x/crypto v0.53.0
• github.com/noyddev/noyd-public-sdk

✅ Testing Done

• All Go files compile without syntax errors
• Documentation is properly formatted Markdown
• Docker configuration is valid
• CI/CD workflow syntax is valid
• Issue template is properly structured

📝 Notes

• All PQC constants match the noyd-public-sdk implementation
• Tools use Cloudflare CIRCL library for real cryptographic operations
• No secrets or credentials in any generated code
• Prohibits reverse-engineering of proprietary NOYD Core binary

🔗 Related Issues

None - initial implementation

📸 Screenshots

See repository README for the complete program overview.

---

This PR was generated to establish the NOYD vulnerability disclosure program infrastructure.

@noyddev can click here to continue refining the PR