docs: move root .md files into docs/ + update every reference

Picks up the file renames that landed alongside the previous commit
and fixes everything that pointed at the old root locations:

- README.md doc-map updated: every entry now points at docs/X.md,
  with a new "docs/" lead entry pointing at the guided-tour index.
- README inline cross-refs (ARCHITECTURE / INTEGRATION / SECURITY /
  BENCHMARKS / MES_INTEROP / PROOFS) repointed to docs/.
- README "Interop" section rewritten — used to mention only
  secsgem-py; now covers all four external validators (secsgem-py
  31 / secs4java8 55 / tshark 69 frames / libFuzzer 200 k+ runs)
  with a one-line summary each, plus pointers to interop/README.md
  and docs/VERIFICATION.md.
- README "Deferred follow-ups" cleaned: dropped the explanatory
  "Listed here so reviewers don't go looking for them in
  COMPLIANCE.md and find an 'out of scope' entry that sounds
  defensive" sentence — the section header speaks for itself.
- docs/00_index.md "Where the rest of the docs live" table: dropped
  every `../` prefix since the docs are now siblings.
- docs/01_what_is_secs_gem.md PROOFS reference updated to sibling.
- docs/02_the_cast.md INTEGRATION + MES_INTEROP refs updated to
  siblings; dropped the stale "at the repo root" wording.
- interop/README.md: VERIFICATION + PROOFS refs updated to
  ../docs/X.md; stale "~24 + 4 checks" updated to 31 (matches
  PROOFS.md and README).
- examples/pvd_tool/README.md: every doc cross-ref now points at
  ../../docs/X.md.
- Source / data / CI comments mentioning doc names (e.g.
  "INTEGRATION.md §3", "COMPLIANCE.md gap") rewritten to
  "docs/INTEGRATION.md §3" etc. — affects 9 files across
  include/, apps/, tests/, data/, examples/, .gitea/workflows/.

Verified: full build under docker passes, 445/445 test cases pass,
2 753/2 753 assertions pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

examples/pvd_tool/README.md

@@ -108,15 +108,19 @@ from `main.cpp` directly — each section is independently usable.
 
 - **Persistence.** The demo server's `--spool-dir` flag is the
   pattern to copy.  Add `model->spool.enable_persistence(...)` etc.
-  at startup before binding the port.  See INTEGRATION.md §5.
+  at startup before binding the port.  See
+  [`docs/INTEGRATION.md`](../../docs/INTEGRATION.md) §5.
 - **E84 handshake timers.** No load-port AMHS wiring; see
-  INTEGRATION.md §4.6 for the `E84AsioTimers` adapter.
+  [`docs/INTEGRATION.md`](../../docs/INTEGRATION.md) §4.6 for the
+  `E84AsioTimers` adapter.
 - **Real I/O bridges.** Sensor values come from a random-walk
   simulator.  A real PVD tool would have a PLC/serial driver
   module-bridge feeding `model->svids.set_value(...)` from real
   hardware.
-- **Production deployment hardening** — SECURITY.md (nftables,
-  stunnel, minisign signing) and INTEGRATION.md §7 (HA pattern).
+- **Production deployment hardening** —
+  [`docs/SECURITY.md`](../../docs/SECURITY.md) (nftables, stunnel,
+  minisign signing) and
+  [`docs/INTEGRATION.md`](../../docs/INTEGRATION.md) §7 (HA pattern).
 
 ## What you'd change for *your* tool
 
@@ -141,13 +145,14 @@ classes.  ~1,100 lines of vendor code on top of the library.
 
 ## Cross-references
 
-- [INTEGRATION.md](../../INTEGRATION.md) — the conceptual tutorial
-  this example concretizes
-- [ARCHITECTURE.md](../../ARCHITECTURE.md) — how stores compose, how
-  to extend
-- [BENCHMARKS.md](../../BENCHMARKS.md) — what the throughput
-  envelope looks like
-- [SECURITY.md](../../SECURITY.md) — production hardening configs
-- [apps/secs_server.cpp](../../apps/secs_server.cpp) — the demo
+- [`docs/INTEGRATION.md`](../../docs/INTEGRATION.md) — the conceptual
+  tutorial this example concretizes
+- [`docs/ARCHITECTURE.md`](../../docs/ARCHITECTURE.md) — how stores
+  compose, how to extend
+- [`docs/BENCHMARKS.md`](../../docs/BENCHMARKS.md) — what the
+  throughput envelope looks like
+- [`docs/SECURITY.md`](../../docs/SECURITY.md) — production hardening
+  configs
+- [`apps/secs_server.cpp`](../../apps/secs_server.cpp) — the demo
   server's fully-loaded Router (every handler PVD inherits + a
   few more)

examples/pvd_tool/main.cpp

@@ -20,7 +20,7 @@
 // fork this single file as a starting template.
 //
 // What's *not* here that production deployment needs:
-//   - SECURITY.md: nftables, stunnel, minisign signing.
+//   - docs/SECURITY.md: nftables, stunnel, minisign signing.
 //   - The other router handlers (S5/S6/S7/S10/S14/S16) — apps/
 //     secs_server.cpp has them all.  We register the ones a demo
 //     host actually exercises here.
@@ -109,7 +109,7 @@ constexpr uint32_t kAlarmCleaningNeeded  = 10;
 //   - Wafer counters, EPT hours: on-event, not polled
 //
 // All updates marshal onto the io_context via asio::post — that's
-// the thread-safety contract documented in INTEGRATION.md §3.
+// the thread-safety contract documented in docs/INTEGRATION.md §3.
 
 struct Simulator {
   asio::io_context& io;