docs: add Truth Plane enforcement plan (surfaces, egress gate, incident semantics)

[mdheller]

Adds docs/TRUTH_PLANE.md describing how the SourceOS substrate enforces the canonical contract layer: truth surfaces + delta surfaces generation/attestation, default-deny frontier egress with short-lived grants, runtime truth capture, and explicit Freeze→Fork→Kill incident semantics.

Boundary preserved: contract shapes live in SourceOS-Linux/sourceos-spec; this repo implements enforcement. See docs/BOUNDARIES.md.

[mdheller]

@copilot fix failed checks

[Copilot]

@copilot fix failed checks

Fixed in commit dc75a6f. I investigated the failed CI runs, reproduced the markdownlint failures locally, and updated the two Truth Plane docs to satisfy lint rules. Local markdownlint "**/*.md" now passes.

[mdheller]

Update: added docs/TRUTH_PLANE_IMPLEMENTATION.md (v0 implementation slice) to the PR branch.

This pins the first end-to-end enforcement slice:

• default-deny frontier egress + short-lived allow windows + replay cache
• minimal TruthSurface emitter (system.sealed)
• minimal DeltaSurface emitter (system.sealed)
• incident.freeze (phase 1)

Next: wire these behaviors to the canonical contracts in SourceOS-Linux/sourceos-spec (TruthSurface.json, DeltaSurface.json, incident-events.schema.json).