[P1] docs(security): filesystem-family admission matrix + P0-AC scope notes (RFC-0005 gate) #441

Priority: P1 | Area: area:security | Labels: docs,P1,area:security | Milestone: v0.1.0 | RFC: OQ-085/OQ-056 | Task: CTX-0281

RFC-0004 precedent (bitty-docs PR #433): add the filesystem-family admission cells to docs/security/threat-model.md (OQ-085 matrix, filesystem domain, L0–L4 cells for the new fs family — mint NO identifiers, park to implementation) + P0-AC-035/030/024/013 scope notes in docs/security/p0-acceptance-criteria.md, gating RFC-0005 (PR #440, commit 0b0bab1, APPROVE PX-0933) acceptance.

Acceptance criteria:

• docs/security/threat-model.md: new filesystem-domain family admission subsection with L0–L4 cells (RFC-0005 family shape: read/write/list verbs, scoped grants, typed oracle-tight denials); mints no identifier; exact spellings/caps parked to Core bridge + SDK implementation; authorizes no implementation.
• docs/security/p0-acceptance-criteria.md: additive scope notes under P0-AC-035/030/024/013 referencing the new admission table.
• Purely additive diff (0 deletions) following the Threat-model matrix + P0-AC-035 for history-read family (RFC-0004 F-01/F-08) #433 pattern.
• just check + act -n green.
• PR Refs this issue (no Closes); do NOT merge — gates RFC-0005 acceptance.