Move the CVD Policy to the Security section of the documentation - #554

The site side of the new Documentation → Security section, added in SpineEventEngine/documentation#88. The Coordinated Vulnerability Disclosure Policy moves from /cvd-policy/ to /docs/security/cvd-policy/, next to the new Security policy and Verifying artifacts pages.

What changed

• Module pin: documentation is pinned to the head of Add style for quotes #88 (1d7c3e1). MVS also raises validation/docs from 2026-05-22 to 2026-05-23, the version documentation requires. go.sum only gains the four lines the bump needs; no tidy.
• Old page removed, redirect added: site/static/cvd-policy/index.html redirects to the new page.
  • GitHub Pages can't send HTTP redirects, so it's a meta refresh page with rel=canonical and noindex, like the ones Hugo generates for aliases.
  • GitHub Pages already redirects /cvd-policy to /cvd-policy/.
  • Its URLs are site-relative on purpose: lychee checks a redirect page's canonical link, and an absolute URL would be checked against the live site, where the new page doesn't exist until this deploys.
  • The org-wide SECURITY.md and outside sites link to /cvd-policy/, so the redirect must stay.
• Links: the footer's "CVD Policy" link and the Policy: field of security.txt point to the new URL. security.txt also gets its Expires: fixed: 2027-09-10 T13:05… had a stray space, which makes it an invalid RFC 9116 timestamp.
• Numbered headings in docs pages: layouts/docs/single.html now honours has_numbered_headings, as layouts/privacy/single.html does, so the moved policy keeps its numbered sections.
• Numbered TOC fix (_numbered-headings.scss): the #TableOfContents rules never ran before, because no page had put a TOC inside .numbered-headings. The number lacked position: absolute, so it took 30px next to the link's 42px padding instead of sitting inside it. That caused a wide gap, and the flex item shrank on titles that wrap, misaligning them. Two declarations fix it.
• Fresh SECURITY.md (second commit): the Security policy page fetches SECURITY.md from SpineEventEngine/.github at build time.
  • Fetched files now expire after an hour. Hugo's default is never, and check-links restores the Hugo cache between runs.
  • gh-pages.yml gets a workflow_dispatch trigger, guarded to deploy only from master, so a SECURITY.md change can be published without a commit here.

Merge order

Merge SpineEventEngine/documentation#88 first. The pin points to that PR's head commit. If #88 gets new commits before it merges, this pin needs a matching bump. Once #88 merges with a merge commit, 1d7c3e1 stays reachable from master.

Verification

• Built with the pinned module (hugo -e development): no errors; the three Security pages, the redirect and the numbered headings are all present.
• Checked in a browser against the local documentation checkout:
  • the Security section comes last in the sidenav;
  • /cvd-policy and /cvd-policy/ both reach the new page;
  • the footer link works;
  • the body headings and the TOC are numbered;
  • TOC titles stay aligned when they wrap, including in a 180px-wide TOC.
• lychee (this repo's config) on the changed pages: the redirect's links resolve against the local build. The only remaining 404 is the absolute Policy: URL in security.txt, which the CI check doesn't scan (it scans *.html) and which resolves once this deploys.

🤖 Generated with Claude Code