docs(kernel): list ISecurityService in the contracts index

The contracts index table and the runtime-services source-of-truth list
enumerate every published service contract; a new contract missing from
them makes the index quietly wrong. Adds the Security Service row and its
source path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KZ2BGusRo58ZW8FMkDhGTb

Author: claude

content/docs/kernel/contracts/index.mdx

@@ -41,6 +41,7 @@ Service contracts are **TypeScript interfaces** that define the boundaries betwe
 | Contract | Interface | Description |
 |:---|:---|:---|
 | Auth Service | `IAuthService` | Authentication — login, verify, logout, session management |
+| Security Service | `ISecurityService` | Query surface for access decisions — row-level read scope, readable-field projection, effective permission sets, access explanation |
 | Sharing Service | `ISharingService` | Record sharing rules and access grants |
 
 ### Storage & Caching Contracts

content/docs/kernel/runtime-services/index.mdx

@@ -36,6 +36,7 @@ This chapter documents the runtime `services.*` APIs used in hook/action/flow/pl
 Each page links the canonical TypeScript source used to derive signatures.
 
 - Data: `packages/client/src/index.ts`
+- Security: `packages/spec/src/contracts/security-service.ts`
 - Sharing: `packages/spec/src/contracts/sharing-service.ts`
 - Queue: `packages/spec/src/contracts/queue-service.ts`
 - Email: `packages/spec/src/contracts/email-service.ts`