docs: make every standing document true to the repository

An adversarial read of the project found the standing documents asserting controls, processes, and properties the repository does not have. This MR rewrites them to what the pipeline and the project settings actually do, and records the changes in the CHANGELOG.

Changes

• SECURITY.md keeps the runtime posture, what the pipeline demonstrably produces, offline verification with cosign, and a reporting section in the reference project's shape: a confidential issue or sales-pubsec@gitlab.com, what to expect, a severity rubric, and scope. It drops the NIST SP 800-53, SP 800-218, and CMMC control tables, the ITAR/EAR paragraph, a security review at a tag that never existed, a byte-identical rebuild claim, a citation that pointed at an unrelated dependabot pull request, and a 404 disclosure link. It states that it is the maintainers' self-assessment. The FIPS section now cites CMVP certificate #5247 for the Go Cryptographic Module v1.0.0 in place of the earlier "In Review" status.
• The pipeline no longer includes the catalog compliance component. Its fourteen-section, eleven-control baseline describes a control assessment this document is not. SECURITY.md follows the reference project's security-md standard (a private disclosure route, a severity scale, a response timeline) and passes that project's check script.
• The tagline on the hero graphic, the site, and llms.txt claims signed and attested builds. Reproducibility is not asserted, and the hero PNG is re-rendered to match.
• README states the support posture (a GitLab Public Sector field-team project, not a GitLab product, no support entitlement), the fork we build from and the active alternative, the release-tag scheme, real v1.25.19-* tags in every command, and the published architecture, linux/amd64.
• CONTRIBUTING documents what the project enforces (conventional-commit subjects, the branch-name pattern, fast-forward merges behind a green pipeline, Owner review) and drops the sign-off and signed-commit requirements that were never configured. AI-assisted commits carry the Co-Authored-By: trailer the history already uses.
• One CODEOWNERS file naming both Owners; .gitlab/CODEOWNERS is removed.
• CHANGELOG gains the v1.0.1 and v1.0.2 headings their content was missing, an [Unreleased] entry covering !25 (merged) and this MR, and the Removed entry for the fips-strict variant.
• The site names BuildKit and Buildah as the GitLab-documented paths and says when this image is the right choice, discloses the fork choice, quotes the current tag in every copy button, and drops the retired variant.
• AGENTS.md and .ai/*.md describe the six-variant build and the enforced rules, so an agent reading them produces conforming commits.
• The authors label on all three images points at the active mailbox.

Verification

vale with the gitlab_base and gitlab_docs styles at warning level reports zero findings across README, SECURITY, CONTRIBUTING, and CHANGELOG. Every external link added returns 200, including the NIST certificate page and the go.dev FIPS page. The site's section count and both inline SVGs were checked after each edit.

Stacked on !25 (merged); merge that first. v1.25.19 is cut once both have landed.