docs: add threat model and safety boundaries

[butcer0]

Summary

Adds a threat model and safety-boundary document for codex-mesh, with an explicit README entry point.

The new document defines the trust boundaries around Codex agents, terminal transport, Beads state, CUE contracts, scripts, and operator-facing mesh surfaces. It separates durable semantics from transport behavior and records the project’s fail-closed expectations for lifecycle commands and verification.

Changes

• Added docs/threat-model.md
• Added a README pointer to the new threat model
• Documented trusted inputs, untrusted inputs, and boundary assumptions
• Clarified that Beads and CUE own durable semantics, while shell scripts and terminal state remain transport surfaces
• Captured safety expectations for spawn, tell, jump, mesh status, mesh watch, and wave dispatch behavior