security

Create GitHub pull requests with the gh CLI using the repo-local PR template (.github/pull_request_template.md), then update CHANGELOG.md with the created PR ID and commit the changelog (do not push). Use when a user asks to open a PR and record its ID in the changelog.

Create a mitigation tracking GitHub issue and update the threat model table tracking link.