docs: add CLAIMS.md for token scoping, audit trace integrity, and fail-closed behavior

[dgenio]

Add a receipts-first claims page for agent-kernel. Cover token scoping, principal-bound handle expansion, fail-closed behavior, audit trace creation, and boundary claims vs AgentFence/contextweaver. Each claim should point to a test, example, or command. Include explicit non-claims: not a sandbox, not host authentication, not a hosted gateway, not a guarantee that host code cannot bypass the kernel. Link from README and security docs.

[dgenio]

Closing as completed/consolidated by merged PRs #276 and #281. docs/security-contract.md is now the canonical claims/non-claims page, the README links it prominently, docs/security.md expands the trust model, and tests/test_invariants.py provides the named executable evidence for I-01/I-02/I-06. Keeping a separate CLAIMS.md would duplicate the exact security surface we now want to maintain in one place.