docs(security): add public docs folder with security overview

[chaliy]

What

Adds a top-level docs/ folder for public-facing documentation, starting with a security overview article.

Why

Bashkit has extensive internal security documentation (specs, threat model, rustdoc guides) but no user-facing summary. This gives users a single entry point to understand the security model.

How

• docs/security.md: High-level security article covering:
  • Core security boundaries (VFS, no process execution, network allowlist, resource limits)
  • Threat model overview with all TM-* categories
  • Link to the published rustdoc threat model
  • POSIX deviations made for security
  • Security testing layers (threat model tests, fail-point injection, network/error/logging tests, fuzzing, differential tests)
  • Panic safety
  • How to report vulnerabilities (security@everruns.com)
• AGENTS.md: Updated Documentation section to distinguish docs/ (public) from crates/bashkit/docs/ (rustdoc)

Tests

Docs-only change. All 2000+ existing tests pass. fmt and clippy clean.