docs: add manual security disclosure collection

[TheDZhon]

The disclosure ledger is missing the August Accounting Oracle / VEBO post-mortem, and there is no repeatable way to compare forum disclosures against it. This adds a manual candidate collector and the reviewed ledger entry.

Stacked on #960. The base is chore/update-audits-and-lips so this PR shows only the disclosure additions. After #960 merges, retarget this PR to main and update its base as needed.

Changes

• Add npm run fetch-disclosures, using docs: add new audit reports and LIP-37 #960's existing lib/http, lib/markdown, and lib/tasks helpers and exported run() convention.
• Discover keyword-matched forum topics, including weakness/weaknesses, within an inclusive UTC activity window, fetch their complete post streams in batches, and compare numeric topic ids against the local ledger.
• Write timestamped reports into the existing ignored .security-triage/ directory, containing source links, ids, dates, hashes, candidates, already-listed topics, routing exclusions, and errors. Do not persist titles, bodies, or author identities.
• Return nonzero for incomplete pagination or failed topic collection. Document that keyword selection and product routing require human review and cannot establish exhaustive disclosure coverage.
• Add the August 6 Accounting Oracle / VEBO post-mortem as Incident / Low, and clarify that the main ledger focuses on Lido's staking business.
• Add mocked regression tests and manual usage documentation.

The existing audit/LIP/quorum fetchers, aggregate fetch command, shared helpers, redirects, dependencies, and CI workflows are unchanged. Live forum collection is a separate manual command; it does not publish ledger rows or assign severity.

Evidence and validation

Source: https://research.lido.fi/t/11756/3 — August 6 is the post-mortem publication date. Low is the reviewed editorial classification.

• npm test: 82 tests passed (70 inherited and 12 new).
• npm run build: passed.
• git diff --check: passed.
• Live collection for March 23–September 11 against docs: add new audit reports and LIP-37 #960's original ledger: candidate 11756, already-listed 11342, nine product/operator exclusions, complete collection, zero errors.
• Live collection for March 23–September 12 against the updated ledger: zero new candidates, two already-listed disclosures, nine exclusions, complete collection, zero errors.

npm run fetch-disclosures
npm run fetch-disclosures -- --since 2026-03-23 --until 2026-09-11