FIX-14: Reconcile the duress-safe-state claim with the docs

[ChelseaKR]

The README, privacy doc, and threat model described a "duress-safe open
state that hides case contents" as an existing capability, but grepping
src/ and app/ for duress/panic/decoy returns nothing — it is
not implemented. For a tool whose credibility rests on "say what it does
not do," a safety feature that exists only in prose is an overclaim.

Reword every present-tense mention to state the duress-safe state is
planned, not yet implemented, and that its documented limits will apply
when built. This is FIX-14's immediate S-scope (docs correction only);
building the feature is EXP-15 (sized L) and is out of scope here.

• README.md: principle 5, the "Duress and forensic limits" honest-limit,
  and the "Safety" -ility now mark the state planned; location-stripping
  stays correctly present-tense as the only shipped at-rest/ sharing
  protection.
• docs/privacy.md: "Device seized" mitigation cell annotates the duress
  state as planned, not yet implemented.
• docs/threat-model.md: honest-limits bullet leads with "planned, not
  implemented"; the seized-while-unlocked row reduces to passphrase
  rotation + recovery blob with the duress state noted as planned; the
  §7 summary no longer implies the state exists.
• docs/crypto-spec.md: non-goal reference now points to the "planned
  duress mitigation and its limits".

Docs-only change; full non-integration suite (196 tests) passes. No
source, test, or script references the changed text.

Note: the roadmap doc (docs/ideation/02-large-scale-fixes.md) is
untracked in the main repo's working tree and absent from this isolated
worktree, so FIX-14 could not be marked done there without committing
unreviewed WIP; that bookkeeping is left to the working-tree owner.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

---

Backfill PR for a completed roadmap item (roadmap/fix-14-reconcile-the-duress-safe-state-c, 1 commit(s) over main). Part of the portfolio roadmap batch.