docs(security): SECURITY.md points the MCP proxy DNS residual at closed #5061

Why

SECURITY.md:52 says the resolve-versus-connect DNS-rebinding residual in api/mcp-proxy.ts is "tracked in issue #5061". #5061 closed on 2026-07-13 with no comments. The live tracker is the draft advisory GHSA-887j-p88r-qmm9, updated 2026-09-04, the day after #7605 reverted the Node-runtime socket pin.

State of the residual (verified 2026-09-15)

• api/mcp-proxy.ts re-resolves and classifies A and AAAA answers before each fetch, then discards the vetted address. tests/mcp-proxy.test.mjs, tests/mcp-bounded-json.test.mjs, and tests/edge-functions.test.mjs pass (387).
• #7578 and #7591 moved the route to Node and pinned the socket. #7605 reverted both after FUNCTION_INVOCATION_FAILED on OPTIONS and GET in production. The cause was never diagnosed. #7605 named two gaps: the live smoke gate only ever skipped, and the preview was never probed.
• .github/workflows/mcp-live-smoke.yml now runs scripts/mcp-live-smoke.mjs against worldmonitor.app and www.worldmonitor.app every 15 minutes and on every Production deploy. Four green runs on 2026-09-15. Previews are excluded by design.

Do

1. Repoint SECURITY.md:52 at the advisory, or reopen a tracking issue.
2. Before any retry of the Node migration, pull the Vercel invocation logs for the request IDs in #7605 and name the cause. Add a preview probe with a deployment-protection bypass token so the smoke runs before merge, not only after.

A retry today would be detected within 15 minutes by the cron smoke, but not prevented.