feat(engine): sync confidential opt-out + threat model (#22, #23)

[mopanc]

Summary

Bundle E of the v1.0.0-rc.1 plan — closes the two remaining security-roadmap gaps that block tagging rc.1.

• S0-10 sensitivity: confidential opt-out from sync (security gap C) #22 — sensitivity: confidential opt-out from sync (gap C). saga sync scans the layer notes dir, parses frontmatter, and excludes matched files from git add via a :(exclude)<path> pathspec. Confidential files stay on disk, never staged, never pushed. A new --dry-run flag prints the plan (pending + excluded) without mutating anything. If a confidential topic's file already exists in origin/<branch> (was pushed previously), sync emits a warning explaining that local marking is not retroactive and pointing to a manual cleanup workflow until saga sync --purge lands.
• S0-11 SECURITY.md threat model update (security gap D) #23 — SECURITY.md threat model (gap D). SECURITY.md rewritten with: Threat model (what Saga protects / what it does not), Trust boundaries, Storage at rest (and why no encryption at rest in v1), Sync transport, Secret handling (pattern list), sensitivity: confidential semantics, Scope, Disclosure. README gets a short "Security model" section linking into it.

One non-trivial design decision

The personal layer seed previously defaulted to sensitivity_default: confidential. With #22 implemented as the issue describes, that default would make every new topic local-only — defeating the entire point of a syncable personal layer. Flipped to internal. confidential is now the explicit per-topic opt-out the issue asks for (credentials notes, medical info, etc.).

The change only affects new installs. Existing layers keep whatever value is already in their meta.yml — users with the old default can migrate at their own pace.

Test plan

• go test ./... — full suite green
• golangci-lint run — 0 issues
• New tests in internal/saga/sync_test.go:
  • TestSyncExcludesConfidentialTopicsFromPush — confidential file does not appear in remote clone after sync
  • TestSyncConfidentialFileStaysLocal — file remains on disk after sync
  • TestSyncDryRunListsPendingAndExcluded — dry-run reports plan without committing/pushing
  • TestSyncWarnsWhenConfidentialAlreadyInRemote — flipping a pushed topic to confidential surfaces the warning
  • TestSyncNoWarningWhenConfidentialNeverPushed — clean case stays warning-free
• Manual smoke on Jorge's actual layer (post-merge, after the seed-default migration)

Closes #22
Closes #23