[conching]

Summary

• pin the reviewed LC Bricks MCP and LC Core hardening commits
• add root integration CI and a private security-reporting policy
• align setup guidance around a separate site-specific plugin/mu-plugin
• make the audit bundle complete and provenance-aware

Dependency pull requests

• Harden MCP persistence and release integrity lc-bricks-mcp#1
• Harden imports and release tooling lc-core#1

Merge both dependency pull requests before this parent pull request so the pinned commits are reachable from their default branches.

Verification

• root integration workflow reproduced locally
• audit bundle generated successfully with tests, manifests, workflows, first-party assets, and exact commit hashes
• both plugin test suites and production release builds passed
• all three worktrees were clean before publication