Zod maintainer refuses v3 CVE backport because advisory is agent-written

At least fix the docs that say v3 gets security fixes