docs: add capability-token threat model and misuse cases

[dgenio]

Add a capability-token threat model for agent-kernel. Cover assets and trust boundaries around tokens, principals, handles, driver output, policy decisions, and audit traces. Include misuse cases such as token replay, confused deputy, wrong principal binding, unsafe handle expansion, driver tampering, audit-log gaps, and host-code policy bypass. State non-goals clearly: agent-kernel is not a sandbox, not a host authentication system, and not a network isolation layer. Acceptance: document is linked from README/security docs, includes mitigations/test

[dgenio]

Closing as completed/consolidated by merged PR #276. docs/security-contract.md + the rewritten docs/security.md now cover the requested assets/trust boundaries and misuse/non-goal cases: principal authenticity, token scope/replay/constraints, complete-mediation/host bypass, handle expansion, driver/output boundary, audit trust assumptions, multi-worker state, sandbox/network/authentication non-goals, and links to executable/security hardening issues. The named invariant suite from merged PR #281 now supplies the executable I-01/I-02/I-06 regression layer. Future threat-model findings belong in those canonical documents rather than a second token-specific threat-model page.