chore: Updated security workflow readme

[shashank-factory]

Summary

Updates the README.md to document the new security workflow capabilities and the modular sub-action architecture introduced for parallel code and security reviews.

Changes

• New commands documented: Added documentation for @droid security, @droid review security, and @droid security --full commands
• Parallel review flow: Added new section explaining how code review and security review run in parallel when both are enabled
• Advanced workflow example: Added comprehensive YAML example for parallel workflow setup using modular sub-actions (prepare, review, security, combine)
• Security configuration: Documented new security-specific inputs including:
  • automatic_security_review
  • security_model
  • security_severity_threshold
  • security_block_on_critical/high
  • security_notify_team
  • security_scan_schedule/days
• Sub-actions table: Added documentation for the modular sub-actions (Factory-AI/droid-action/prepare, /review, /security, /combine)
• Security skills section: Documented the Factory skills used for security reviews (threat-model-generation, commit-security-scan, vulnerability-validation, security-review)
• Configuration reorganization: Restructured configuration section into Core Inputs, Review Configuration, and Security Configuration tables
• Formatting updates: Converted bullet points from * to - for consistency

Testing

Documentation-only changes. No code changes to test.

Related Issues

closes https://linear.app/factoryai/issue/FAC-14927/update-readme-with-new-structure-around-the-security-workflow

[factory-droid]

Docs-only PR; no code changes to validate. No additional P0/P1 bugs introduced by this diff.

Note: an existing review thread suggests removing the @droid review security command mention from README if that’s not supported/desired behavior.

[factory-droid]

Docs-only PR; no new P0/P1 issues found in this diff. (Existing threads about command naming/mentioning have been resolved.)

[factory-droid]

Droid finished @shashank-factory's task —— View job

---

[factory-droid]

[P1] Document the correct security command name

Repo code/tests and action.yml reference @droid security-review (and @droid review security), but this README documents @droid security; users will invoke the wrong command and the workflow won’t trigger as expected.

[factory-droid]

[P1] Avoid promising REQUEST_CHANGES from composite action

README claims the security action will submit REQUEST_CHANGES on critical/high, but GitHub Actions tokens generally can’t create “request changes” reviews; promising this behavior is likely incorrect and will mislead users configuring enforcement.

[factory-droid]

Docs change looks directionally right, but it currently documents a security command name/behavior that doesn’t match what the repo code/tests/action inputs expect, which will cause users to invoke unsupported commands. Please align README with the implemented trigger(s) and avoid promising enforcement behavior that GitHub Actions can’t perform.