docs(commercial): security layer v2 statuses

[RaghavChamadiya]

What

Documentation-only update to COMMERCIAL.md reflecting what is now live on the hosted platform:

• Graph-aware security scanning: dev to GA on hosted (hotspot/centrality context on import sites, agent-facing get_security MCP tool and the get_risk security section).
• Function-level reachability triage: planned to GA on hosted, with per-ecosystem coverage stated honestly (Go import-path-reliable; pypi/npm/cargo only when both the advisory and the code name symbols; others package-level).
• SBOM row gains VEX export (CycloneDX 1.6, generated from current triage).
• Compliance reporting (PCI-DSS 4.0 + SOC 2): planned to GA on hosted (Teams), framed as coverage signals, not an audit.
• Slack / Teams alerting: rolling out to GA on hosted (Teams) as signed webhooks; section 5.2 prose updated to match.
• Audit trail row gains the opt-in webhook stream; prose notes MCP reads by AI agents are audited too.

No code changes.

[repowise-bot]

✅ Health: 7.6 (unchanged)
_{2 hotspots}

⚠️ Change risk: moderate _{(riskier than 35% of this repo's commits · raw 7.7/10)}
This change's risk is driven by:

• large diff (many lines added)
• scattered, high-entropy change

🔥 Hotspots touched (2)

• .../health/config.py — 1 commits/90d, 5 dependents · primary owner: Raghav Chamadiya (100%)
• .../health/test_health_config.py — 1 commits/90d, 0 dependents · primary owner: Raghav Chamadiya (100%)

---

📊 Full report · ⭐ Star Repowise · 📥 Install bot · Last updated 2026-06-12 04:19 UTC
_{Silence on a single PR with [skip repowise] in the title · Per-repo toggle on repowise.dev/settings?tab=bot}