docs(security): ci netns, knowledge .git tmpfs, matrix id/secret split

Security fixes landed without updating the security-model docs; bring them
current as present-tense invariants:

- security.md: matrix identities are public / cross-agent-readable via
  GetAgentMeta while the token stays private; name validation extends to
  GetAgentMeta; the nix-build blast radius has a network dimension (hive-ci
  netns) alongside the 0600 token policy.
- boundary.md: the core dashboard /api has no app-layer auth — protection is
  the gateway plus network isolation; stated as a standing invariant.
- ci.md: hive-ci runs in its own private netns behind the bridge, reaches the
  forge via the gateway, and cannot reach host-loopback (dashboard/forge port).
- knowledge.md: /knowledge excludes .git via tmpfs so the core token in
  .git/config isn't readable by agents.

Refs #2308, #2310, #2313.

docs/knowledge.md

@@ -64,6 +64,11 @@ before returning.
   from the host clone on every container start. Gone when container
   is stopped; reappears on next start with the current clone state.
 
+The mount deliberately **excludes `.git`**: the host clone embeds the `core`
+token in `.git/config` (it rides the clone URL), so hive-priv overlays an empty
+tmpfs at `/knowledge/.git` — agents see the documents, not the repo metadata or
+token.
+
 ## Contributing
 
 Agents are read-only collaborators on `internal/knowledge`, so they