docs: close Silver governance, DCO, accessibility and hardening criteria

[JacobOptimiza]

Silver criteria evidence

Docs-only PR. Adds verifiable evidence for OpenSSF Silver criteria not blocked by external actions:

• DCO: canonical DCO 1.1 file + Signed-off-by requirement for new contributions (no history rewrite).
• Governance / roles: GOVERNANCE.md documents the real single-maintainer model, the roles table, honest bus factor 1, and the emergency-successor model with sebassm — explicitly marked invitation pending, not effective access.
• Code of Conduct: Contributor Covenant 2.1, using existing contact channels (GitHub issues / repository owner profile). No invented private email.
• Accessibility: ACCESSIBILITY.md — real audit of the TUI (keyboard-only operation, WCAG AA contrast table verified against src/render.rs constants) with residual limitations documented.
• Hardening: HARDENING.md — audit of memory safety, release profile, parser fuzzing, network/TLS surface (PowerShell-only HTTPS to GitHub, platform TLS 1.2+, default certificate validation), supply chain (SHA-pinned actions, OIDC npm publishing, reproducible builds) and residual limitations.
• Vulnerability response: SECURITY.md gains an explicit response process and credit policy; verified zero published GitHub security advisories.

Gates

• cargo fmt/check/test (171 passed)/clippy/deny: OK
• Rust production coverage 1610/1838 lines (87.60%), 2809/3255 regions (86.30%): OK
• Analyzer unit tests: OK
• PSScriptAnalyzer + Pester coverage 563/685 commands, 358/432 lines: OK
• npm tests + line coverage 93.79%: OK
• No production, workflow, or release file changes.