v0.4.3 changelog, update CVE response policy

CHANGELOG.md

@@ -4,13 +4,14 @@ All notable changes to NotAlterra are documented in this file.
 
 ---
 
-## [v0.4.3] — 2026-06-09
+## [v0.4.3] — 2026-06-14
 
 ### Fixed
 - **Dashboard counts** — "Saves" now shows `.bak` recovery file count, "Backups" shows `.tar.gz` archive count
 - **Backup mtime preservation** — tar archives now store source file modification times, preventing epoch dates on restored files
 - **Navigation bound** — restore backup picker no longer stops before migrated entries
 - **Save folder dialog** — pre-fills with the current path if one is already set
+- **Disclaimer sentinel not removed on decline** — rejecting the disclaimer now deletes the `NOTALTERRA_LICENSE_ACCEPTED` sentinel file, so the disclaimer reappears on the next launch. Previously, acceptance was irrevocable even through the "View disclaimer" menu item.
 
 ## [v0.4.2] — 2026-06-09
 

docs/GOVERNANCE.md

@@ -12,7 +12,7 @@ maintainer becomes unavailable.
 | Code review | All changes pass through CI (`cargo check`, `cargo test`, `cargo doc`). Human review is performed by the maintainer before signing. |
 | Release | Signed GPG tag by the maintainer. No automated tag creation. CI builds, packages, and attaches provenance. |
 | Policy documents | Maintainer drafts. Significant changes are committed with justification in the commit message. |
-| Security issues | Reported via email. Patched within 48 hours. Disclosed publicly after patch release. |
+| Security issues | Reported via email. Patched within 14 days for serious issues, 90 days for standard. Disclosed publicly after patch release. |
 
 ## Maintainer