security: document Carapace threat model and non-goals

[puremachinery]

Problem

Several planned architecture changes depend on a shared security model: outbound networking, dispatcher routing, prompt-extension skills, memory, plugin revocation, and channel abstractions. Without a concise threat model, every implementation issue has to re-litigate assets, attackers, and non-goals.

Goal

Write a small threat model document that is practical enough to guide implementation and review. This should be a working engineering artifact, not a sprawling exercise.

Scope

• Assets: credentials, config secrets, auth profiles, session history, Matrix state, plugin binaries, device/node tokens, audit logs, user memory, and agent reasoning/output.
• AI-specific asset flow: agent reasoning, tool results, and outputs can become an exfiltration vector when copied into later LLM requests to third-party providers.
• Attackers: remote channel sender, malicious plugin publisher, compromised plugin, malicious website/browser context, hostile network peer, compromised paired node/device, and compromised local non-operator account where applicable.
• Non-goals: Carapace defends operator integrity against external attackers and compromised integrations; it does not defend operators from themselves or defend against root/admin control of the host OS.
• Supply chain position: define the bar for upstream Rust dependencies, such as cargo-audit/cargo-deny/cargo-vet expectations, and explicitly state that full SBOM attestation is out of scope unless separately approved.
• Trust boundaries: local operator, paired device/node, channel sender, plugin, LLM provider, tool output, fetched media, browser client, and OS credential store.

Acceptance criteria

• Add or update a concise threat-model document under docs/.
• Include assets, attackers, trust boundaries, defended properties, and non-goals.
• Include review guidance for future network broker, dispatcher, skills, memory, and plugin-revocation work.
• Link the document from the security docs index or equivalent discoverable place.
• Keep the document specific enough that future issues can cite it for audit retention, redaction policy, and dispatcher exemption decisions.