chore: add Apache Camel K threat model and triage sidecar

[oscerd]

What

Adds a threat model for Apache Camel K under docs/:

• docs/threat-model.md — the project's implicit security contract: intended use and non-goals, the central trust boundary (RBAC to create/patch a camel.apache.org CR == arbitrary code/container execution in the target namespace), the adversary model, security properties provided vs. explicitly disclaimed, downstream (operator/deployer) responsibilities, known misuses, recurring non-findings, and a closed set of triage dispositions so an inbound report can be routed to exactly one outcome with a section citation.
• docs/threat-model.yaml — a derived sidecar carrying the triage-relevant facts in structured form, for automated/AI-assisted triage. The prose document is canonical.

Why

Camel K has no SECURITY.md and no Camel-K-specific security page. The Apache Camel umbrella Security Model (camel.apache.org/manual/security-model.html) is published and is the Camel PMC's triage reference — but it explicitly scopes itself to "Camel … embedded in someone else's application, not a multi-tenant managed service" and does not address the Kubernetes operator / Custom Resource / cluster layer.

Camel K is precisely the layer that builds and operates Camel applications on a cluster. This document is therefore the additive Camel-K sub-project expansion of the umbrella model for the cluster/operator/CR trust boundary that model deliberately excludes — a strict superset that does not contradict it. It gives maintainers and triagers a stable reference for classifying vulnerability reports, scanner findings, and AI analyses against Camel K specifically.

Notes

• This is not an audit, pentest, CVE list, or build-hygiene checklist — it describes the project as it is: the contract between Camel K and the clusters that run it.
• Produced with the threat-model-producer rubric and ratified by a maintainer; every non-trivial claim carries a (documented) or (maintainer, 2026-05-18) provenance tag, and the appendix back-maps specific umbrella Camel Security Model statements to the relevant sections.
• One item is intentionally open and non-blocking — Q-meta: the publication venue and linking (where docs/threat-model.md should live — it is not currently published by the Antora docs site — and whether the Camel security pages should link to it). The substance of how it coexists with the umbrella model is settled (additive sub-project expansion for the excluded cluster layer); only the venue/linking remains a docs/PMC decision.

🤖 Generated with Claude Code

[squakez]

Thanks for the work! LGTM, however I wonder if we can have some way to automate the changes to this as long as we change the code. In the future we're planning to change some of the design that are mentioned in the document, so this is likely to change often.

[oscerd]

We could work on a way of recreate this periodically