docs: centralize documentation under docs/

Move standalone repository docs from the root into docs/ and add a documentation index that links the moved docs and the code-local runbooks.

Update Markdown links, source comments, and the root entry points to the new locations. Keep README.md and AGENTS.md at the root as required entry points.

Assisted-by: DeepSeek Harness (deepseek-flash)

hardening/README.md

@@ -1,7 +1,7 @@
 # Linux Hardening
 
 Deployed and interactively validated on the Linux desktop host (2026-10-31). Policy and limits:
-[SECURITY.md](../SECURITY.md).
+[SECURITY.md](../docs/SECURITY.md).
 
 ## Why these apps are sandboxed
 

hardening/kernel-hardening.nix

@@ -2,7 +2,7 @@
 {
   # Keep this baseline independent of a particular kernel CVE. User namespaces
   # remain available for Nix builds, rootless containers and application sandboxes.
-  # See SECURITY.md for compatibility constraints and post-deployment checks.
+  # See docs/SECURITY.md for compatibility constraints and post-deployment checks.
   boot.kernel.sysctl = {
     "kernel.dmesg_restrict" = lib.mkDefault 1;
     # NixOS already sets mkDefault 1; use a stronger default, still overridable