docs: reconcile SDK docs to reality + add a docs-honesty CI gate

[fas89]

What & why

Closes the packaging/docs dimension gap from the audit: the docs advertised
symbols that don't exist (carried over from the renamed-away fluid_provider_sdk)
and a fabricated CLI transcript. This makes the docs honest and adds a CI gate
so they can never drift again.

Changes

• New CI gate tests/unit/test_docs_honesty.py — scans every Markdown doc for
  from fluid_sdk… import X statements and fluid_build.<group> names and asserts
  each one resolves/imports (and is in __all__), plus that every advertised role
  harness exists and subclasses PluginTestHarness. Written test-first: it fails on
  the real bugs below, then goes green once fixed → durable anti-drift.
• Removed documented-but-nonexistent exports: PluginHookSpec, CostEstimate,
  invoke_hook, has_hook (and the fictional "hooks" section), replaced with the
  real capabilities() + two-tier PluginError/PluginInternalError model.
• Documented the real provision_action / catalog_entry_action helpers + the
  typed Severity/ActionStatus/Phase domains.
• Labelled an illustrative scaffold-engine transcript as non-literal.
• Added an SDK↔CLI compatibility matrix (architecture.md) and a concrete
  plugin trust-boundary section (SECURITY.md: FLUID_PLUGINS_ALLOWLIST/BLOCKLIST,
  type-only error logging) — now accurate because the CLI wiring landed.

Borrow-before-build

Surveyed Sphinx nitpicky / doctest / mkdocs link-checkers for doc-drift linting;
diverged intentionally — a ~80-line zero-dep "every documented import resolves"
check fits a stdlib-only SDK far better than a full Sphinx toolchain.

Verification

• 144 tests pass (8 new gate tests); ruff + black clean.
• Security review: no findings — the gate's importlib.import_module is
  hard-prefixed to first-party fluid_sdk.* (no escape to arbitrary modules), file
  reads are fixed-pattern globs, and it's a test (not shipped API).