Add SicarioSpec Security & Governance Bundle to community catalog

- Adds sicario-spec v0.5.1 entry to bundles/catalog.community.json
- Adds row to docs/community/bundles.md
- Bundle provides 1 extension (sicario-guard) and 11 presets
- Required companion preset and extension catalogs are documented in README
- Validated: bundle ID, version, repository, release artifact, catalog entry shape, checklists

Closes #3619

Assisted-by: GitHub Copilot (model: claude-sonnet-4.6, autonomous)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

bundles/catalog.community.json

@@ -1,6 +1,35 @@
 {
   "schema_version": "1.0",
-  "updated_at": "2026-07-15T00:00:00Z",
+  "updated_at": "2026-07-22T00:00:00Z",
   "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/bundles/catalog.community.json",
-  "bundles": {}
+  "bundles": {
+    "sicario-spec": {
+      "name": "SicarioSpec Security & Governance Bundle",
+      "id": "sicario-spec",
+      "version": "0.5.1",
+      "role": "security-engineer",
+      "description": "Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, and code-owned verification gates.",
+      "author": "SicarioSpec Contributors",
+      "license": "MIT",
+      "download_url": "https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/sicario-spec-0.5.1.zip",
+      "repository": "https://github.com/dfirs1car1o/sicario-spec",
+      "requires": {
+        "speckit_version": ">=0.9.0"
+      },
+      "provides": {
+        "extensions": 1,
+        "presets": 11,
+        "steps": 0,
+        "workflows": 0
+      },
+      "tags": [
+        "security",
+        "governance",
+        "compliance",
+        "appsec",
+        "threat-modeling"
+      ],
+      "verified": false
+    }
+  }
 }

docs/community/bundles.md

@@ -9,6 +9,7 @@ Accepted community bundle entries are published in [`bundles/catalog.community.j
 
 | Bundle | Purpose | Role or team | Provides | Required catalogs | URL |
 |--------|---------|--------------|----------|-------------------|-----|
+| SicarioSpec Security & Governance Bundle | Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, and code-owned verification gates. | `security-engineer` | 1 extension, 11 presets | Documented | [sicario-spec](https://github.com/dfirs1car1o/sicario-spec) |
 
 ## What to Submit