Separate the published tree from internal planning material

[HackTuah]

The repository is public and is read by people evaluating the project for adoption. This change
separates what those readers need from what is internal to building it.

What moved out of the published tree

Per-increment specifications and working notes (159 files), the forward roadmap, the process
templates, the internal process document and the process checker. They were the largest non-code
directory in the repository and described how the work is organised rather than what the software
is or what it guarantees. They are retained by the maintainers.

What replaces them, so the public record is not weaker

• CHANGELOG.md, derived from the tags rather than written from memory, recording what each
  increment delivered and how it was verified.
• docs/03-conventions.md gains two sections lifted from the internal contract and rewritten
  as project standards: the engineering rules (modularity behind behaviours, compiled architectural
  boundaries, OTP supervision, no runtime evaluation of model output, pinned dependency versions,
  tests that do not reach the network) and the rules of evidence (a failing test before the fix,
  populations derived by command, verification naming its exit code, records appended not
  rewritten, deferrals carrying an owner and a lift condition).
• README.md gains an assurance posture table stating the properties the build enforces and
  what enforces each: memory safety by language choice, architectural integrity by a compile-time
  boundary check, least privilege for effects through the permission gate and the separation of
  identity from authority, auditability through an Ed25519 signed receipt chain, untrusted-content
  handling at the boundary, approved cryptography measured on a FIPS-mode CI leg, supply-chain and
  licence audits on every commit, DCO provenance enforced twice, and the standards register's rule
  that no public claim is made without a row and an evidence path.

Verification

mix gate exits 0: formatting, compile with warnings as errors, boundary check, release build
check, Credo strict, Sobelow, dependency and licence audits, 561 tests, coverage floor.

The gate keeps every check that applies to published code and drops only the internal process
check. Three tests asserting the shape of an internal document moved with it. The gate alias test
previously asserted that the process checker was the final step; it now asserts the release check
is present exactly once, which is the property that actually protects the build.