docs: add deployment security and shell workflow

[joey-huckabee]

Summary

• document rootless standalone Linux deployment with Podman Quadlet, systemd lifecycle, journald logging, update, and rollback
• add the component threat model, control ownership, cyber-review evidence, and expanded forward-looking release gates
• consolidate runtime testing on the complete Bash suite for native Linux and WSL2 without losing scenarios
• make upgrading the existing Ubuntu WSL2 Podman environment the first next roadmap action

Validation

• pre-commit run --all-files
• complete tests/smoke.sh passed with rootless Podman 3.4.4 under Ubuntu 22.04.5 WSL2
• verified no documentation names the reference repository
• GitHub topics aligned for the NGINX workload