docs: DESIGN, CONTRIBUTING and RELEASING catch up with the code

[vyncint]

• DESIGN §4: two character sets are translated, DEC Special Graphics and
  the UK set, not one, and DECSC/DECRC save and restore the charset state;
  LS2/LS3 are still not modelled. The charset and tab-stop scopes are
  listed in docs/LIMITATIONS.md, not the README, which has neither (docs: DESIGN §4 says one character set is translated and DECSC does not save charset state; both are stale #535).
• DESIGN §5: env_clear() also pins SHELL=/bin/sh unless the test sets it,
  and why (env_clear() still hands the child a SHELL, and it is the machine's rather than the caller's #221) (docs: DESIGN §5 describes TERM and env_clear but not the SHELL=/bin/sh default #536).
• CONTRIBUTING §2: a bullet for tools/, preflight.sh and the gate
  self-tests (docs: CONTRIBUTING §2's project layout does not mention tools/ #537).
• RELEASING step 1: the two copies of the version no gate checks, the
  bug report form's placeholder and SKILL.md's "Written against" line. The
  placeholder stayed at 0.5.0 through eleven releases, 0.6.0 to 0.11.1,
  not the six the issue said; checked against git history (docs: RELEASING step 1 does not list the bug report form's version placeholder #540).

From the same review, verified before changing:

• ci.yml: the "single stable job name for branch protection" comment sat
  above the skill job; it is back above required-green. Comment-only.
• The emit fixture's rule listed every timer but the 10 ms poll --idle
  waits for SIGTERM with.
• LIMITATIONS.md: "modeled" beside five "modelled" in the same file, and
  "behavior" where the rest of the docs write "behaviour".

Closes #535
Closes #536
Closes #537
Closes #540