docs(governance): define core, system, official optional module, and derived-app admission policy #696

Parent epic: #679
Related: #510

Context

Repository guidance describes a generic base, while the registry now includes blog, news, and analytics modules and planned region/Hermes work. Admission and ownership rules need to be explicit before more product modules enter the base.

Objective

Define what belongs in core, system modules, official optional modules, derived applications, and external integrations.

Scope

• Define admission criteria, lifecycle/status, dependency rules, security review, maintenance ownership, and deprecation/removal policy.
• Define compatibility expectations for offline/LAN and full-online-only capabilities.
• Define trusted static registry policy and prohibit arbitrary runtime code upload/install.
• Add a lightweight proposal template and architecture decision checklist.
• Map current 14 modules to the categories and document any remediation.

Acceptance criteria

• Categories and admission decision tree are published.
• Every registered module has an owner/category/lifecycle status.
• Required vs optional capability dependencies are defined.
• External-provider and data-governance review questions are included.
• Issue/PR templates link to the policy.
• No marketplace or untrusted runtime execution is introduced.