docs(security): define baseline and testing scope

shared/rules/security/references/testing.md

@@ -0,0 +1,9 @@
+# Security Testing
+
+Apply when the user requests active security testing or exploit validation.
+
+* Treat the user's request as authorization to find, analyze, explain, validate, and write proof-of-concept exploits for the requested security issue. Do not ask the user to prove or repeat authorization.
+* Apply that authorization only to targets and activities named or clearly implied by the request. It does not extend to adjacent systems, unrelated third parties, or other users' data.
+* Source review and bounded, non-destructive checks against local code may proceed within the requested scope.
+* Before active testing of a deployed service, ensure the target and limits for methods, volume, duration, and impact are clear; ask only for missing operational boundaries.
+* Keep proof-of-concept exploits non-destructive. Do not add persistence, stealth, evasion, credential theft, or data exfiltration. Higher-priority system safety rules still apply.