docs: define QA and support responsibility scope

[ShortArrow]

Summary

Fixes the previously implicit quality-assurance and service-responsibility boundary in one place.

• ADR 0047 (Quality Assurance and Support Scope) — new:
  • Per-release verification matrix (native test + smoke per RID, both container arches, version guard) and the acknowledged gap (Integration suite is nightly, not a release gate).
  • Pre-1.0 compatibility contract: --json output schemas and the config.toml / scenario TOML schema are stable; breaking either requires a minor bump + explicit CHANGELOG entry. Everything else may change until 1.0.
  • Real-instrument policy: a point-in-time verified-instrument list (recorded version, no continuous re-verification — avoids an unbounded hardware matrix); unlisted instruments are best-effort standards conformance, bug reports with an IVICLI_CAPTURE log expected.
  • Support level: GitHub issues, best-effort, no SLA; latest release only, no backports.
• SECURITY.md — private vulnerability reporting via the GitHub Security tab, latest-release-only fixes, and scope notes (loopback-default Management API, unauthenticated-by-design instrument protocols, mock container is a test fixture).
• README (EN/JP) — user-facing "Support & quality" section with the verification summary, the compatibility promise, and the verified-instruments table (Kikusui PWR801L @ v0.2.6). Status line refreshed to v0.2.8.
• CONTRIBUTING (EN/JP) — navigation-hub link to ADR 0047 / ADR 0016 / SECURITY.md.

Notes

• Companion to ci(release): test and smoke every shipped architecture natively #91, which implements the native per-arch verification that ADR 0047 §1 describes. Merge ci(release): test and smoke every shipped architecture natively #91 first.
• Bilingual pairs (README, CONTRIBUTING) updated in lock-step for docs-sync-check.