docs(DEN-1316): add browser contract architecture and governance

[ORESoftware]

Summary

Documents the shipped browser-facing Zed contracts that were absent from the architecture index and closes the repository's explicit licensing/security-policy gap.

Changes

• documents the deterministic offline zed release plan --json browser-review architecture;
• records the merged accessibility, print, JavaScript-disabled, and Chromium/Firefox/WebKit contract from zed-cli#31 and docs: land native dependency and install-hook lifecycle on current main #33;
• documents the real flags2env C-to-WebAssembly runtime, ownership, input limits, Emscripten portability, isolated worker RPC, timeout/termination behavior, and Chromium/Firefox/WebKit contract from flags-2-env#15 and Doc 19: the registry does not know what language a package is #17;
• marks both implementations accurately as shipped rather than “in review”;
• adds MIT LICENSE and private-first SECURITY.md;
• pins every documentation checkout action, disables persisted credentials, and adds explicit permissions, timeout, and concurrency cancellation.

Final validation

All workflows passed on exact head adea7652e3dc4cbfb46867d38903d39fe617757d:

• cross-repository documentation/deep-link CI, including all newly documented implementation links;
• agents policy.

No unresolved review threads remain.

Related implementation

• feat(DEN-1301): review release plans offline with Playwright zed-cli#31 / DEN-1301
• feat(DEN-1343): harden release reports across accessibility and print modes zed-cli#33 / DEN-1343
• feat(DEN-1300): run the native parser in browsers with Playwright ORESoftware/flags-2-env#15 / DEN-1300
• feat(DEN-1342): isolate browser parsing in workers across three engines ORESoftware/flags-2-env#17 / DEN-1342

Linear: DEN-1316
Parent: DEN-612

[linear-code]

DEN-1316