[arin30]

Summary

• add the ASF-wide security@apache.org CVE bookkeeping sender default
• have setup collect current CNA reviewer addresses without guessing personal addresses
• document the resolved configuration source and add regression coverage for reservation and reviewer-comment messages

Type of change

• Skill change
• Python package
• Project template
• Other

Test plan

• uv run --project tools/security-management pytest tools/security-management/tests/test_issue_import.py — 50 passed
• uv run --project tools/security-management ruff check tools/security-management/tests/test_issue_import.py
• git diff --check
• prek run --all-files — CI will run the full repository gate

RFC-AI-0004 compliance

• Vendor neutrality — project-specific reviewer addresses remain adopter configuration
• Conversational + correctable — setup asks for current reviewer addresses and never guesses them
• Write-access discipline — no new outbound mutation is introduced

Linked issues

Closes #1735

Notes for reviewers

If an ASF adopter supplies reviewer addresses, setup writes a complete project-level list containing both security@apache.org and those addresses. This matters because project configuration replaces rather than merges with the organization default.

AI assistance disclosure: this change was prepared with Codex and manually reviewed and tested before submission.