[bundle] Add SicarioSpec Security & Governance Bundle to community catalog (#3636)

* Add SicarioSpec Security & Governance Bundle to community catalog

- Adds sicario-spec v0.5.1 entry to bundles/catalog.community.json
- Adds row to docs/community/bundles.md
- Bundle provides 1 extension (sicario-guard) and 11 presets
- Required companion preset and extension catalogs are documented in README
- Validated: bundle ID, version, repository, release artifact, catalog entry shape, checklists

Closes #3619

Assisted-by: GitHub Copilot (model: claude-sonnet-4.6, autonomous)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: revert sicario-spec bundle entry pending upstream README correction

The upstream README uses mutable raw.githubusercontent.com/main catalog URLs
instead of the v0.5.1 release-pinned URLs submitted in issue #3619, failing
the required-catalog consistency check. Removing the catalog entry and docs
row until the README is updated to match the submitted pinned URLs.

Assisted-by: GitHub Copilot (model: claude-sonnet-4-5, autonomous)

* Revert "fix: revert sicario-spec bundle entry pending upstream README correction"

This reverts commit 94ee596.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Manfred Riem <15701806+mnriem@users.noreply.github.com>

Author: 4 people

bundles/catalog.community.json

@@ -1,6 +1,35 @@
 {
   "schema_version": "1.0",
-  "updated_at": "2026-07-15T00:00:00Z",
+  "updated_at": "2026-07-22T00:00:00Z",
   "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/bundles/catalog.community.json",
-  "bundles": {}
+  "bundles": {
+    "sicario-spec": {
+      "name": "SicarioSpec Security & Governance Bundle",
+      "id": "sicario-spec",
+      "version": "0.5.1",
+      "role": "security-engineer",
+      "description": "Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, and code-owned verification gates.",
+      "author": "SicarioSpec Contributors",
+      "license": "MIT",
+      "download_url": "https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/sicario-spec-0.5.1.zip",
+      "repository": "https://github.com/dfirs1car1o/sicario-spec",
+      "requires": {
+        "speckit_version": ">=0.9.0"
+      },
+      "provides": {
+        "extensions": 1,
+        "presets": 11,
+        "steps": 0,
+        "workflows": 0
+      },
+      "tags": [
+        "security",
+        "governance",
+        "compliance",
+        "appsec",
+        "threat-modeling"
+      ],
+      "verified": false
+    }
+  }
 }

docs/community/bundles.md

@@ -9,6 +9,7 @@ Accepted community bundle entries are published in [`bundles/catalog.community.j
 
 | Bundle | Purpose | Role or team | Provides | Required catalogs | URL |
 |--------|---------|--------------|----------|-------------------|-----|
+| SicarioSpec Security & Governance Bundle | Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, and code-owned verification gates. | `security-engineer` | 1 extension, 11 presets | Documented | [sicario-spec](https://github.com/dfirs1car1o/sicario-spec) |
 
 ## What to Submit