docs: post-tag runbook, security roster, spec additions (v0.4.1 amendments)

[dean0x]

Summary

Complete post-release documentation: add the partial-failure runbook to RELEASING.md, update SECURITY.md to roster the debug-panics gate, create a normative error-code registry in spec.md, fix community-hygiene templates, and address lockfile consistency.

Deferred Issues

From review [wave-v0.4.0-wave1/2026-08-19_1216]:

Finding	File:Line	Reason
compliance-01	SECURITY.md:65	Not in this diff; the underlying property is independently verified clean.
compliance-02	RELEASING.md:126	Its urgency is a function of F-05/F-07; write the runbook after those settle.
consistency-13	spec.md	A new normative error-code registry is a substantial spec addition; amendable in 0.4.1.
consistency-17	.github/ISSUE_TEMPLATE/bug_report.yml:16	Community hygiene; zero release risk.
consistency-18	package-lock.json:2	Touching the lockfile before an irreversible publish is the worse trade.

Acceptance Criteria

• Add partial-failure runbook to RELEASING.md
• Document debug-panics gate in SECURITY.md
• Create normative error-code registry in spec.md
• Update bug_report.yml template for clarity
• Verify package-lock.json is consistent with dependencies

Related

• PR v0.4.0 Wave 1: breaking changes, live-bug fixes, and release-safety gates #308 (wave/v0.4.0-wave1)
• Post-release cleanup

For v0.4.1 (amendable)