[medium][docs] Populate on-call rotation

[dantaik]

Tracked under #21.

Scope

Stand up a real on-call rotation and wire it into the runbook.

Steps

1. Set up a PagerDuty or Linear schedule for the on-call rotation
2. Update docs/runbooks/security-disclosure.md § "Paging rotation" with the real schedule URL
3. Replace the degenerate-single-person rotation language once a second maintainer exists (depends on the second-CODEOWNER sub-issue)
4. Define severity → page-level mapping:
   • Critical: SMS + page in 5 min
   • High: email in 1h
   • Medium / Low: queued

Acceptance criteria

• A real PagerDuty / Linear schedule URL is in docs/runbooks/security-disclosure.md
• Severity → page-level mapping is defined and documented in the runbook
• Paging drill (separate sub-issue) confirms the rotation works end-to-end