docs(context): add alpha.2 security hardening and functional options rollups

[zeevdr]

Summary

• Adds Security Hardening (alpha.2 cycle) section: TLS-by-default (feat(server): enforce TLS for gRPC + gateway dial #230), panic recovery (feat(server): add panic recovery interceptor #229), rate limiting (server: per-tenant + per-method rate limiting #216/feat(server): add per-tenant + per-method rate limiting #267, LRU-capped in Bound InProcessLimiter.keys map (LRU or TTL) #287), validation limits (schema: bound field count, doc size, JSON-Schema compile time #217/feat(schema): configurable ingest limits + functional options for NewService #254/feat(validation): JSON-Schema compile timeout + depth pre-scan #256), audit tenant access (Audit handlers do not enforce tenant access #207/fix(audit): enforce tenant access on read handlers #209), metadata bounds (auth: bound metadata header lengths and sanitise resolution errors #260), gRPC message size limits (server: enforce gRPC message size limits #212/feat(server): enforce configurable gRPC message size limits #226), pluggable Guard chain (feat(authz): pluggable Guard interface + ChainGuard #269/refactor(config/schema/audit): extract resolveTenantWithAccess and errToStatus #270), supply chain attestations (ci: add artifact attestations for Docker images and Go binaries #266/ci+build: digest-pin base images, SHA-pin non-trusted actions #227), Helm hardening (helm: sane resource defaults, NetworkPolicy template, pull-Always #261)
• Adds Schema Publishing (alpha.2 cycle) section: schemas.opendecree.dev via GitHub Pages (feat(schemas): publish meta-schemas to schemas.opendecree.dev via Pages #263)
• Adds Functional Options Refactor (alpha.2 cycle) section: all 7 constructors across refactor(server): functional options for New + NewGateway #235, refactor(audit,auth): functional options for NewUsageRecorder + NewInterceptor #236, refactor(config,adminclient): functional options for NewService + New #249, feat(schema): configurable ingest limits + functional options for NewService #254 with per-PR option lists

An agent starting fresh on this repo can now reconstruct the full alpha.2 security posture and API shape from completed.md alone.

Test plan

• Read the new sections and verify accuracy against the referenced PRs
• Confirm no existing entries were modified

Closes #306