docs/THREATS.md lands: each adversary, what it wants, and the protection and test that stand in its way, checked by a test #1687

Replaces what is left of #1149 (the owner's ask). The zero-trust pieces #1396–#1398 are closed.

Done looks like:

• [ ] docs/THREATS.md covers a snooper on the network, a stolen token, a compromised vendor, a hostile agent inside a run, and an automated attacker at scale. For each, one line on what it wants, and per protection the mechanism and the test file that proves it, or "none yet" said plainly.
• [ ] The internal calls (runner→forge, cell→proxy, edge→pod, child→parent) are listed with how each is authenticated today.
• [ ] Honeypots (a kind: "honeypot" app) are named as later, with what must stand first.
• [ ] test/threats-doc.test.ts: every test file the doc cites exists, and every "none yet" line counts toward a total the test prints.

Start from today's main (0.7.107 or later). Before pushing run bun x tsc --noEmit, the test files this touches and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit. Earlier tries went red because their branch was cut before main changed the home and asks tests: if the check is red on a test this pull does not touch, merge origin/main, run that test here, and push again; if it is still red, name it in the pull.