chore: adopt engineering standard v1.0.0

Adopt the org engineering standard (its-consulting/standards @ v1.0.0).

Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.

Automated rollout. Files created: 15.

SECURITY.md

@@ -0,0 +1,86 @@
+# Security Policy
+
+> Rendered by `adopt-standard.sh` from the standards repo, pinned at
+> **`1.0.0`**. Replace the `{{PLACEHOLDERS}}` and tailor as needed.
+> This is the adopter-facing variant of the standard's own
+> `SECURITY.md`; keep the no-plaintext-secret rule and the data traffic-light intact.
+
+This policy applies to **`its-consulting/Homeassistant`**. It is derived from our engineering
+standard (pinned in [`.standards-version`](.standards-version)).
+
+---
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem** — a public issue widens
+exposure before a fix exists (a private repo is *non-public*, not *secret-safe*).
+
+1. Email **kenearos@googlemail.com** with the subject prefix `[SECURITY] Homeassistant`.
+2. Include: affected file/component, the version/commit you observed it on, a minimal
+   reproduction, and the impact you foresee.
+3. **Never paste a real secret, private key, token, or production hostname** into the
+   report. If a credential leaked, report *that it leaked and where* — then **rotate
+   it first**, before anything else.
+
+Expect acknowledgement within **3 business days** and a triage decision within
+**10 business days**. We prefer **coordinated disclosure**: please give us a
+reasonable window to ship a fix before any public write-up.
+
+---
+
+## Secret policy — no plaintext secrets in git, ever
+
+**No plaintext secret material is committed to this repository, not even "just for a
+minute" and not even though the repo is private.**
+
+- **Encrypted-only.** Machine-readable secrets are encrypted with **SOPS + age**
+  before they touch git. Only `*.enc.*` / `*.sops.*` ciphertext and `*.example`
+  placeholders belong in version control.
+- **age keys, not the KeePass master password.** Use **dedicated age keys**.
+  **KeePass remains the human vault** (emergency codes, manual credentials, key
+  backups). Never reuse the KeePass master password for other crypto purposes.
+- **SSH keys.** Private keys are **never** committed; public keys may be versioned.
+- **A FIDO2 / hardware-token path** is supported for the age identity.
+
+This is enforced, not honour-system:
+
+| Layer | Mechanism |
+|-------|-----------|
+| Pre-commit (local) | `gitleaks` + `sops-encrypted-check` in [`.pre-commit-config.yaml`](.pre-commit-config.yaml); secret-safe [`.gitignore`](.gitignore) |
+| CI `security-scan` | secret + dependency scanning |
+| CI `policy_check` | Rego policy from the pinned standard |
+
+If a secret is ever committed: treat it as compromised, **rotate it immediately**,
+then scrub history. Rotation comes first.
+
+---
+
+## Data traffic-light
+
+Classify every piece of content before committing:
+
+| Light | Meaning | Rule |
+|:-----:|---------|------|
+| 🟢 **GREEN** | Technical content, **no** personal data. | OK in the repo. |
+| 🟡 **YELLOW** | **Minimized** personal reference — roles / IDs, not real names. | Use **sparingly**. |
+| 🔴 **RED** | Sensitive personal data, **plaintext secrets, private keys**. | **Never** in the repo. Encrypt secrets (SOPS+age) or keep personal data out entirely. |
+
+---
+
+## Supported versions
+
+| Version | Supported |
+|---------|-----------|
+| Latest release of `Homeassistant` | ✅ Yes |
+| Older releases | ❌ Upgrade first |
+
+The standard this repo adopts follows SemVer; bump
+[`.standards-version`](.standards-version) deliberately and read its CHANGELOG
+migration notes.
+
+---
+
+## References
+
+- [`CONTRIBUTING.md`](CONTRIBUTING.md) · [`CODEOWNERS`](CODEOWNERS)
+- [`.pre-commit-config.yaml`](.pre-commit-config.yaml) · [`.standards-version`](.standards-version)