feat: implement Phase 4 Security & Compliance (SOURCES.md, SECURITY.md) [skip ci]

docs/SOURCES.md

@@ -0,0 +1,21 @@
+# 📜 Sources & Attributions
+
+We believe in giving credit where credit is due.
+If you recognize your work here and it is not properly attributed, please open an Issue.
+
+| Skill / Category            | Original Source                                        | License        | Notes                         |
+| :-------------------------- | :----------------------------------------------------- | :------------- | :---------------------------- |
+| `cloud-penetration-testing` | [HackTricks](https://book.hacktricks.xyz/)             | MIT / CC-BY-SA | Adapted for agentic use.      |
+| `active-directory-attacks`  | [HackTricks](https://book.hacktricks.xyz/)             | MIT / CC-BY-SA | Adapted for agentic use.      |
+| `owasp-top-10`              | [OWASP](https://owasp.org/)                            | CC-BY-SA       | Methodology adapted.          |
+| `burp-suite-testing`        | [PortSwigger](https://portswigger.net/burp)            | N/A            | Usage guide only (no binary). |
+| `crewai`                    | [CrewAI](https://github.com/joaomdmoura/crewAI)        | MIT            | Framework guides.             |
+| `langgraph`                 | [LangGraph](https://github.com/langchain-ai/langgraph) | MIT            | Framework guides.             |
+| `react-patterns`            | [React Docs](https://react.dev/)                       | CC-BY          | Official patterns.            |
+| **All Official Skills**     | [Anthropic / Google / OpenAI]                          | Proprietary    | Usage encouraged by vendors.  |
+
+## License Policy
+
+- **Code**: All original code in this repository is **MIT**.
+- **Content**: Documentation is **CC-BY-4.0**.
+- **Third Party**: We respect the upstream licenses. If an imported skill is GPL, it will be marked clearly or excluded (we aim for MIT/Apache compatibility).