Evaluate security headers for the public documentation site

## Context

OpenSSF Best Practices asks projects to consider secure delivery of project sites. Registry Stack has a public docs site, but the repo does not currently track a public decision about HTTP security headers for that site.

## Scope

- Inventory which security headers are currently applied to the public docs site, without publishing private hosting details.
- Decide which headers are appropriate for a static documentation site, such as HSTS, Content-Security-Policy, Referrer-Policy, X-Content-Type-Options, and Permissions-Policy.
- If the repo owns the deployment header config, add it and verify it.
- If headers are controlled outside the repo, document the public expectation and the verification command instead.

## Done when

- The repo has a public issue or doc decision for docs-site security headers.
- The chosen headers are either configured in repo or documented as an operator/deployment requirement.
- A repeatable check or manual verification command is documented.

## Non-goals

- Do not expose private hosting provider settings, deployment credentials, or internal infrastructure notes.

Start by locating the public documentation site's deployment configuration and inspect its live HTTP response headers; no file or test is named in the issue. Record the selected headers and either verify the repository configuration or document the operator requirement with a repeatable check, excluding private hosting details.

Written by the indexing model from the issue text.