docs: move root .md files into docs/ + update every reference

Picks up the file renames that landed alongside the previous commit
and fixes everything that pointed at the old root locations:

- README.md doc-map updated: every entry now points at docs/X.md,
  with a new "docs/" lead entry pointing at the guided-tour index.
- README inline cross-refs (ARCHITECTURE / INTEGRATION / SECURITY /
  BENCHMARKS / MES_INTEROP / PROOFS) repointed to docs/.
- README "Interop" section rewritten — used to mention only
  secsgem-py; now covers all four external validators (secsgem-py
  31 / secs4java8 55 / tshark 69 frames / libFuzzer 200 k+ runs)
  with a one-line summary each, plus pointers to interop/README.md
  and docs/VERIFICATION.md.
- README "Deferred follow-ups" cleaned: dropped the explanatory
  "Listed here so reviewers don't go looking for them in
  COMPLIANCE.md and find an 'out of scope' entry that sounds
  defensive" sentence — the section header speaks for itself.
- docs/00_index.md "Where the rest of the docs live" table: dropped
  every `../` prefix since the docs are now siblings.
- docs/01_what_is_secs_gem.md PROOFS reference updated to sibling.
- docs/02_the_cast.md INTEGRATION + MES_INTEROP refs updated to
  siblings; dropped the stale "at the repo root" wording.
- interop/README.md: VERIFICATION + PROOFS refs updated to
  ../docs/X.md; stale "~24 + 4 checks" updated to 31 (matches
  PROOFS.md and README).
- examples/pvd_tool/README.md: every doc cross-ref now points at
  ../../docs/X.md.
- Source / data / CI comments mentioning doc names (e.g.
  "INTEGRATION.md §3", "COMPLIANCE.md gap") rewritten to
  "docs/INTEGRATION.md §3" etc. — affects 9 files across
  include/, apps/, tests/, data/, examples/, .gitea/workflows/.

Verified: full build under docker passes, 445/445 test cases pass,
2 753/2 753 assertions pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

examples/pvd_tool/main.cpp

@@ -20,7 +20,7 @@
 // fork this single file as a starting template.
 //
 // What's *not* here that production deployment needs:
-//   - SECURITY.md: nftables, stunnel, minisign signing.
+//   - docs/SECURITY.md: nftables, stunnel, minisign signing.
 //   - The other router handlers (S5/S6/S7/S10/S14/S16) — apps/
 //     secs_server.cpp has them all.  We register the ones a demo
 //     host actually exercises here.
@@ -109,7 +109,7 @@ constexpr uint32_t kAlarmCleaningNeeded  = 10;
 //   - Wafer counters, EPT hours: on-event, not polled
 //
 // All updates marshal onto the io_context via asio::post — that's
-// the thread-safety contract documented in INTEGRATION.md §3.
+// the thread-safety contract documented in docs/INTEGRATION.md §3.
 
 struct Simulator {
   asio::io_context& io;