docs: v0.4.3 docs bundle — spec §4.6 filesystem constraints, §5 error-code registry, §7.8 reserved field; SECURITY.md debug-panics roster; RELEASING.md partial-failure runbook; bug template; KB refresh (#327, #328, #313)

[dean0x]

Release-surface trigger

This PR touches crates/mds-python/tests/test_parity.py, one of the six RELEASE_SURFACE paths, so release.yml runs automatically on the pull_request event and verify-pr-checks.mjs requires Version gate, Stage + verify platform packages and Rehearse PyPI publish (no upload); the CI-history gate is step-skipped on pull_request, so one manual gh workflow run release.yml --ref docs/d2-v043-docs-bundle follows CI completion. Two Release runs on this head are expected.

What changed (7 commits)

• 7c80354 spec §4.6 "Filesystem constraints" subsection (relative form, empty path, NUL bytes, symlink rejection, root containment, path encoding, segment count — codes, messages, pinning tests) + SECURITY.md pointer (spec §4.6 Imports "Rules:" omits symlink rejection — spec/implementation drift on a security control #327)
• 44df359 spec §7.8: fmt.sort_frontmatter_keys documented as reserved and currently inert (Question: should spec §7.8 document fmt.sort_frontmatter_keys, a deliberately inert config field? #328)
• 6f26d1a spec §5 "Error Codes" registry — 26 mds-core codes (each code(mds::…) attribute in error.rs, verified 26 unique, each used once) + 4 binding-only codes; §7.9 cross-reference; packages/mds/src/types.ts JSDoc and packages/bundler-utils/__test__/errors.spec.mjs test-helper default corrected from the nonexistent mds::undefined_variable to mds::undefined_var (docs: post-tag runbook, security roster, spec additions (v0.4.1 amendments) #313 iii)
• 34b58c7 SECURITY.md debug-panics roster corrected to mds-napi / mds-wasm / mds-python (was mds-core) with the release-build claim scoped to the named build commands; RELEASING.md partial-failure recovery runbook + three drift fixes (CI-watch hint, publish-npm → publish-python is sequential per release.yml needs:, [Unreleased] wording) (docs: post-tag runbook, security roster, spec additions (v0.4.1 amendments) #313 i, ii)
• 4ac7ba5 bug_report.yml: component dropdown 9 → 11 (Python, Rspack loader), version/environment field text; CHANGELOG ### Internal entry; package-lock consistency check recorded (docs: post-tag runbook, security roster, spec additions (v0.4.1 amendments) #313 iv, v)
• 64728a5 test_parity.py comment "9 lint rules" → "10 lint rules" (the legacy_interpolation rule always sets help and span; the assertion is unchanged); mds-lint KB three-byte format hazards 11 → 14; mds-cli KB six subcommands + watch debounce model + atomic-write contract; .devflow/features/index.md completed 5 → 9 features
• 25ec3be (droppable) crates/mds-core/tests/spec_error_codes.rs — pins the §5 registry to error.rs code() strings; 3 tests incl. an in-suite negative control (mds::definitely_not_a_code must NOT be documented); RED demonstrated once on a mangled registry cell, then GREEN

Related issues

Closes #327
Closes #328
Closes #313

#313 acceptance criteria → commit: (i) RELEASING.md partial-failure runbook → 34b58c7; (ii) SECURITY.md debug-panics roster → 34b58c7; (iii) spec §5 error-code registry → 6f26d1a; (iv) bug_report.yml → 4ac7ba5; (v) package-lock consistency check → 4ac7ba5.

package-lock consistency (#313 v)

The root "name": "mdl" in package-lock.json is npm's checkout-directory default: the root package.json is private: true with no name, and it is never published. The lock was verified with npm ci and npm ls --all (tree-ok) plus node scripts/verify-versions.mjs and left untouched — no regeneration (transitive-churn risk right before the version bump) and no root name pin.

Security scan

Snyk code scan unavailable (MCP ENOENT); the security/snyk CI check is SCA-only.

Gates (local, on 25ec3be)

• cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo clippy -p mds-cli --all-targets --features startup-race-probe -- -D warnings, cargo +1.88 check, RUSTDOCFLAGS="-D warnings" cargo doc -p mds-core -p mds-cli --no-deps: clean
• cargo nextest run -p mds-core -p mds-cli: 2364 passed (baseline 2361 + the 3 new pin tests); cargo test --doc -p mds-core: 53 passed
• npm run test:gates: 220 pass / 0 fail (5 spec files); node scripts/verify-ledger-citations.mjs: ✓ 551 files / 1217 tokens; node scripts/verify-no-control-bytes.mjs: ✓ 566 files
• npm run build -w @mdscript/mds, npm run build -w @mdscript/bundler-utils && npm test -w @mdscript/bundler-utils: 91/91
• Python parity (maturin develop + pytest -m "not perf", .venv Python 3.13.1): 250 passed
• Markdown-table width histogram (spec.md + RELEASING.md added rows): exactly two widths (3-column and 5-column tables); absolute-claim sweep reviewed hit by hit (registry all surface cells, two scoped RELEASING.md facts); no added line outside .devflow/features/** carries a ledger-id token; .devflow/features/index.md re-emits only pre-existing, current-meaning ids from KB descriptions