docs: preserve ZSAMPLES findings on main (closing PR submersion-app#260)

Cherry-picks docs/import-formats/macdive-zsamples.md from the Phase 1
spike branch onto main, preserving the institutional knowledge about
why ZSAMPLES decoding was ruled NO-GO (per-dive AES encryption, format
structure observations, enumerated attack vectors).

The Python investigation tooling under scripts/reverse_engineering/
zsamples/ is intentionally NOT preserved — it's single-purpose spike
code for a path we're abandoning.

Also updates the Phase 2 plan to drop the "(landed in submersion-app#260)" qualifier
on the findings-doc reference, since it now lives directly on main.

Author: ericgriffin