docs: align README/SECURITY/C_ABI with shipped state (#17)

* docs: align README/SECURITY/C_ABI with shipped state

The native C core, its Python (cffi) and header-only C++ bindings, and the
"how to use sensorwatch" agent skill have all landed, but several docs still
described them as roadmap/planned.

- README: trim the shipped native-core + Python/C++ bindings out of the roadmap
  (Rust is the only forward-looking binding); reword the Security paragraph
  (agent skill ships; REST service + MCP server are the planned pieces).
- docs/C_ABI.md: the header-only C++ binding now ships -- drop "C++ ... not
  provided yet" from the Status and Non-goals (only Rust is unshipped), matching
  the existing "shipped C++ binding" Binding Notes.
- SECURITY.md: reclassify the native C ABI/DLL + Python/C++ bindings and the
  read-only agent skill as current rather than planned; fix the stale TOC anchor
  for "DLL Security" and drop "(planned)" from "Agent Integration Security"; add
  a C++-binding row and update the agent-integration status rows.
- docs/C_CODING_STANDARDS.md: the CI sanitizer/static-analysis gate exists now --
  present tense instead of "once native code exists".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pf3449ALTVKsLS8Tf776ak

* docs: settle on skill + CLI for agents, drop planned MCP server

Decision: sensorwatch's agent interface is the shipped read-only skill over the
CLI and Python/C/C++ APIs; there is no separate MCP server on the roadmap. If
remote, over-a-protocol access is ever needed, the already-planned localhost REST
service (with its understood HTTP threat model) is the path -- not a bespoke MCP
server that would add network surface against the tool's "no network listeners"
posture.

- README: reframe the Agent integration roadmap bullet around the skill + CLI;
  drop "MCP server ... is next" and the MCP mention from the Security paragraph.
- SECURITY.md: remove the MCP server from Scope and the planned-components list;
  rewrite the Agent Integration section intro and trim its status-table rows to
  the shipped skill; note explicitly that no MCP server is planned (remote access
  deferred to the REST service).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pf3449ALTVKsLS8Tf776ak

* docs: pin C-standards CI claim to what CI runs (no clang-cl job)

Round-1 review (Copilot + reviewer pass) flagged that the present-tense CI claim
overstated coverage: the SHOULD item listed a clang-cl sanitizer/static-analysis
config as something CI "does today", but .github/workflows/ci.yml has no clang-cl
job -- native CI is gcc ASan+UBSan on Linux and MSVC /analyze on Windows. Pin the
"does this today" claim to those, and mark a dedicated clang-cl job as still
aspirational (matching this doc's own secondary-tooling framing).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pf3449ALTVKsLS8Tf776ak

---------

Co-authored-by: Agent for Leonard Janke <leonard.janke.agent@proton.me>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>