fix(rsr-audit): de-brittle SECURITY response-timeline check

Category-2's SECURITY.md check required the exact literal substring
"24 hours", failing repos that document the same SLA differently
("Response Timeline" heading, "48 hours", "business day", etc.).
Broaden to a basic-grep alternation covering the common phrasings,
mirroring #390's format/case de-brittling. Licence-content checks
untouched.

standards' own SECURITY.md (Response Timeline / 48 hours) now passes
where it previously failed — one of the 3 residual fails #390 flagged.

Regenerate REGISTRY.a2ml: rhodium-standard-repositories/ is a registered
spec home, so editing rsr-audit.sh changes its content-addressed hash.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019awZjBD1qx61tvmEuEKNpn

Author: claude

.machine_readable/REGISTRY.a2ml

@@ -216,7 +216,7 @@ name = "RSR — Rhodium Standard Repositories"
 stream = "governance"
 home = "rhodium-standard-repositories/"
 canonical_doc = "rhodium-standard-repositories/README.adoc"
-source_hash = "sha256:2d4e465bee215808306f28053a84d2f146a7fb7f6e6e3780e5d6f4c1d18c7404"
+source_hash = "sha256:01e6373ae01939b5ed24c72e1c4ace7ea55559b3fc765a956bc2e7ad722b244b"
 route = "the repository-compliance standard every repo is graded against"
 
 [[spec]]

rhodium-standard-repositories/rsr-audit.sh

@@ -246,7 +246,9 @@ audit_category_2_documentation() {
     # SECURITY.md validation
     if [[ -f "$REPO_PATH/SECURITY.md" ]]; then
         check_file_contains "SECURITY.md" "Reporting" "SECURITY.md has vulnerability reporting"
-        check_file_contains "SECURITY.md" "24 hours" "SECURITY.md has response timeline"
+        # Estate-tolerant: credit any documented response SLA phrasing, not just
+        # the literal "24 hours" (repos use "Response Timeline", "business day", etc.)
+        check_file_contains "SECURITY.md" "24 hours\\|48 hours\\|72 hours\\|business day\\|[Rr]esponse [Tt]ime\\|SLA" "SECURITY.md has response timeline"
     fi
 
     # CONTRIBUTING.md validation (TPCF)