fix(ontology): secure boot was readable all along, unelevated

`system.boot.secure_boot` was declared when the boot cluster was written
and nothing ever resolved it, so it fell to the unbound-id sweep and
reported "no resolver bound on this build" — on a machine whose own code
comments record it as UEFI with `UEFISecureBootEnabled = 0`. The value was
sitting in the registry the whole time.

Two readers hold this and only one is honest. `boot_config` keeps it in a
`bool` and collapses a failed query with `unwrap_or(false)`, reporting
Secure Boot as *disabled* when it could not be read at all. `firmware`
models it as `SecureBootStatus`, which separates `Disabled` from
`NotSupported` from `Unknown`. Off, unsupported and unread are three
different answers and only one of them is `false`, so `boot_config` is not
used here.

Binding to `firmware` alone was still wrong in effect. It asks
`Confirm-SecureBootUEFI`, which needs Administrator, so it returns
`Unknown` in normal use and the entity read "the firmware flag was not
readable here" — an absence claiming simon cannot read something simon
can. `platform::windows::secure_boot_enabled` reads
`SecureBoot\State\UEFISecureBootEnabled` without elevation and already
returns an `Option`, so the absence survives where it is real.

That is the third time: NVMe in 3.1.0 and ATA in 3.3.0 were both scoped as
needing Administrator and both turned out not to. Check for an unelevated
source before accepting that a reading needs privilege. The note is at the
call site.

A missing `SecureBoot\State` key is reported as its own absence rather than
as `false` — that is what a BIOS/CSM machine looks like, and an agent
auditing posture needs to tell it from Secure Boot being switched off.

Also reattaches `resolve_printers`' doc comment, which an earlier insertion
had orphaned above the wrong function.

Verified: `simon get system.boot.secure_boot` exits 0 with `false
[measured]`. fmt, clippy --all-features --all-targets, both cross-target
checks, and the ontology_conformance / honesty / agentic_contract /
documentation_links suites (47 tests) all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>