docs: add a security policy and bring the design pages in line with the programs that use the kit

[MotherSphere]

Closes the remaining documentation gaps from the conformance audit (DOC-1, DOC-5, DOC-10, REL-2). Docs only: no code, no generated file and no workflow changes.

What changed

• SECURITY.md (new). Private vulnerability reporting (already enabled on this repository), what is in scope (the shared sign-and-publish.yml workflow and its key handling and SignPath gate, the release templates, colony_ui::paths name validation, the colony.json schema), what is out of scope, and the supported versions: the latest colony-ui on crates.io, and main plus the organisation pin for the signing workflow.
• README Status. The 0.1.6 preferences kit is no longer "adopted by no program yet": Colony and Spotter build their Preferences page and identity button from it on colony-ui 0.1.6. The other claims (paths tests on 3 OSes, 0.1.7 waiting on the Trusted Publisher, SignPath wired but unused) are unchanged.
• design/filesystem.md. The Digger row is gone: Digger (repository D1Gg2r) resolves its data and config through colony_ui::paths::locate and copies its old <data>/digger/history.db across once. Spotter is listed as conforming too.
• design/navigation.md, design/settings-page.md. Digger's files are cited from D1Gg2r (src/ui/mod.rs, src/ui/settings/) instead of a src/ui.rs that cannot exist. Both comparison tables are re-checked against current main and gain a Spotter column. Digger's identity button is now sz(15) with [4, 8] padding. Colony no longer has a 200 ms sidebar slide (App::SIDEBAR_ANIM_MS is gone), and its tutorial text now names the Colony title, not a gear icon. The "Colony's fixed 160" category list is described in the past tense, because Colony now uses the kit's list.
• design/repository-layout.md. The "largest files in Colony today" table now shows then and now: theme.rs went from 100 KB to 4 KB, settings.rs from 64 KB to 18.6 KB, and download.rs became src/download/ (six files). The largest file today is src/persistence.rs at 62 KB.
• design/releases.md. "Libraries published to crates.io" now lists a third difference from the template: a 0.x library sets bump-minor-pre-major: true, so a breaking change bumps 0.1.x to 0.2.0, not 1.0.0. This matches release-please-config.json and crates/colony-ui/CHANGELOG.md.

REL-1: the action_required CI run on release PR #18 was approved, so its required checks can run. #18 stays unmerged until the crates.io Trusted Publisher is registered.

How it was verified

• Each claim about another program was checked read-only against its current main: Colony d2e8927, Spotter 5835c2d, D1Gg2r f73cfa4, Grape 08b670d. File sizes come from the git tree API, and the identity button, categories and paths calls come from the source.
• The SECURITY.md scope was checked against sign-and-publish.yml (the key is written to a temp file and removed on exit, signatures are verified after signing, and SignPath refuses to run without its token), against crates/colony-ui/src/paths.rs (.., separators, trailing dot or space, reserved apps), and against the organisation pin in templates/sign-and-publish-caller.yml.
• No em or en dashes were added. No test or generator reads these Markdown files, so cargo run -p colony-tokens -- check is unaffected.