[P0][SEC-01] Threat model and conformance policy

Parent: #1

## Objective
Define the security model before connectors, agents and generated UI acquire capabilities. Every process, data class and effect path must have a named trust boundary and release policy.

## Scope
- Trust zones for shell, supervisor, browser renderer, connectors, external agents, local models, extensions, desktop broker and OS services.
- Threat inventory: prompt injection, confused deputy, credential theft, malicious MCP/tool metadata, hostile pages/files/repos, generated-UI spoofing, supply chain, egress, data poisoning, stale observations and local IPC abuse.
- Effect taxonomy: read, local reversible write, external compensatable write, irreversible/uncertain write.
- Required controls by trust/effect class: sandbox, grants, approvals, verification, audit, reconciliation.
- Supported execution modes and explicitly excluded adversaries (for example fully compromised host kernel).
- Security-conformance requirements for new connectors/providers/components.

## Deliverables
- Versioned threat-model document/dataflow diagrams.
- Trust-boundary inventory with owning crate/process/team.
- Conformance checklist consumed by code review and evaluation suites.
- Security assumptions and non-claims suitable for product documentation.

## Acceptance criteria
- [ ] Every runtime process has declared authority, readable resources and allowed egress.
- [ ] Every connector operation maps to an effect class and required authorization path.
- [ ] Prompt/content cannot be treated as authority by policy definition.
- [ ] Trusted confirmation surfaces and generated/provider content have explicit isolation rules.
- [ ] External coding agents have separate mediated/confined/unconfined trust classes.
- [ ] Threat-model fixtures are represented in EVAL-01/EVAL-02.

## Dependencies
- CORE-01

**First phase:** P0
**Maturity target:** P7 (continuous)
**Workstream:** Authority and security

Review parent #1 and dependency CORE-01 first, then use the listed processes, trust zones, threats, effect classes, and execution modes to structure the threat model and dataflow diagrams. Confirm that the trust-boundary inventory, conformance checklist, security assumptions, and EVAL-01/EVAL-02 fixtures cover every acceptance criterion.

Written by the indexing model from the issue text.