docs: sweep after the fleet fixes; approve the 1.0 spec

- README: custody chain and receipts replace epidemic forwarding; Ack
  frame; running on a robot (host crates, current limits); security;
  crate layout, constants and reading list.
- AGENTS.md: current spec list, receipt constraints and review focus
  7-8, first_seq rule, constants, host crates and the ros2 gate.
- THREAT_MODEL.md: re-checked at 89041ea. F1, F2, F5, F17 fixed; F3
  (single configured peer) and F4 partly fixed; new F18 (no scheduled
  flush, stale clock marker).
- CHANGELOG: Unreleased section for the fleet milestone and fixes.
- tines-bt README: single-peer limit; manual BLE check not yet recorded.
- tines service rustdoc: oversized-frame behaviour, JSON tagging, clock.
- 1.0 spec: approved (2026-10-20), including §10 and the adversarial
  fuzz mode.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tines-bt/README.md

@@ -52,6 +52,12 @@ violation).
 Up to [`MAX_PEERS`] connections may be live at once, one per bound [`NodeId`];
 a second connection to the same [`NodeId`] replaces the first.
 
+**Current limit:** `BluerRadio::new` and `BtTransport::new` still take a single
+`peer`. The allowlist is exactly that one `NodeId`, and `BtTransport` drops
+frames and events from any other peer, so in practice each node exchanges with
+one configured partner. A configurable allowlist (empty = any tines advertiser)
+is still to come; see `THREAT_MODEL.md` F3.
+
 ## Manual verification
 
 The SeqPacket framing can't be exercised in CI (it needs two real radios), so
@@ -64,6 +70,10 @@ verify it by hand with two devices running the `tines` service:
 3. send a burst of observations on one device and confirm the other receives
    each as a separate, intact frame (no merged or truncated frames).
 
+No result has been recorded yet. Once it's done, note the date, hardware and
+BlueZ version here, along with whether SeqPacket worked or the length-prefix
+fallback was needed.
+
 [`Transport`]: https://docs.rs/tines-core/latest/tines_core/transport/trait.Transport.html
 [`NodeId`]: https://docs.rs/tines-core/latest/tines_core/observation/struct.NodeId.html
 [`Radio`]: crate::Radio