Commit the spec or strip references to it; fix doc drift #7

Code comments and READMEs cite "spec §1.2", "§1.5", "§2.2", etc. about 30 times. The spec is not in the repo and is not on disk anywhere. A reader cannot follow any of these references.

Known drift while at it:

• crates/signal-schema/tests/privacy_invariant.rs header still says the differential secret-typing test is "stubbed #[ignore] below and lands with the terminal collector in Phase 2". It is active.
• macos-collector/README.md says "see the project README for a captured run". There is none.
• shell-hooks/signald-hooks.zsh and shell-hooks/README.md say the hooks emit exit codes. They emit keys and session seconds only.
• crates/signald/src/lib.rs module docs still call the hardware collector a stub; update once the ingest issue lands.

Done when:

• Either docs/spec.md (or .org) is committed and every § reference resolves to a heading in it, or the references are replaced with a plain description of the rule.
• The four drift items above are corrected.