Tighten v1 security invariants and define the trusted-computer boundary

[BenWestgate]

The v1 security documentation needs one literal, consistent trusted-computer and secret-output contract.

Required contract:

• define a trusted computer operationally as a machine under the operator's exclusive control, not known or suspected to be compromised, with the OS/Python environment/codex32/bitcoin-cli/Bitcoin Core and relevant configuration trusted for the operation;
• distinguish intentional secret-emitting commands from accidental disclosure so invariant 6 is literally true;
• warn that shell command text can be retained even when prompted or redirected stdin keeps secrets out of argv;
• keep SECURITY.md, the security model/invariants, user guidance, and CLI help consistent.

Implemented and reviewed in PR #59. Reviewed head 580b8f8 passed its focused/CI checks, but current reviewability-v1 has advanced and GitHub now reports the historical documentation head conflicted. Keep this issue open until #59 receives its one final mechanical refresh after the runtime/security stack settles, reconciling the final wording with #23 and the restore behavior in #57/#80/#81. Rerun normal CI and the review-thread audit on that refreshed tip.