docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into the release skills

[lukaszlenart]

Folds what the 7.4.0 / 6.12.0 advisory round (S2-075 … S2-078) taught into the three release skills.

How the gaps were found

Four scenarios were run against the skills on main, with project memory off-limits so only the skills were tested. Each failed:

Scenario	Behaviour on main
Release finishes on a Friday, release manager wants phase 7 closed before the weekend	Nothing in the skills holds advisories over a weekend — the rule existed only in personal memory
Bulletins just went public, "update the Version Notes"	"the notes may link it" produced bulletin links inline in the Bug / Improvement lists, no dedicated section
Fill a freshly reserved CVE record	No guidance on the record's fields: ranges merged across maintenance lines, title double-prefixed with Apache Struts:
Advisory mails sent — "what's left?"	Nothing past the send button: reporter notices, the site PR and the THREAT_MODEL.md §12 re-baseline check went unmentioned

The same four scenarios rerun against this branch all pass, and the CVE-record and Version Notes outputs match what was actually published for S2-075 … S2-078.

Changes

• creating-security-bulletins
  • Publish at the start of a working week — no unrestrict, READY or send on a Friday or before a holiday; prepare and propose Monday.
  • Filling the CVE record — the house JSON shape (one versions entry per bulletin line, Maven packageURL, text severity with the GENERAL scenario, four-part description, CWE chosen and named to the release manager), the JSON-editor write path, and READY as the PMC's last step.
  • After the advisory mails — Version Notes Security section, site PR, one reporter notice per report thread, the threat-model check.
  • Red flags for each, and a description that triggers on CVE-tool work and post-publication wrap-up.
• creating-version-notes — the Security section: placement after Maven users, line format, and the section-update write path; section order, checklist and red flags updated.
• releasing-struts — phase 7 gate names the working-day rule and the follow-ups; the ordering states that ASF Security pushes to MITRE.

🤖 Generated with Claude Code