docs: add Cognitum-style animated README visuals and linked capability cards

[ruvnet]

The README needs visual entry points into its capability documentation. This adds a Cognitum-inspired hero, navigation icons, feature cards, sensing overview, section headers and destination banner, with clickable wrappers and plain-text links to the source guides. The original demo GIF, ruOS promotion and technical headings remain available.

All 20 SVGs are conceptual illustrations. Copy links to current hardware and pose-research limitations, with no new accuracy, performance or medical claims. Essential content stays visible without animation, reduced motion is supported, and assets contain no scripts, foreignObject, remote fonts or embedded remote resources.

The deterministic maintenance tools now use bounded defusedxml parsing with DTDs, entities and external XML references forbidden. Oversized input is rejected before parsing; manifest paths are validated before file access and must stay within the repository or assets directory. Explicit UTF-8 and LF output support reproducible generation on Windows and Linux. The dependency is confined to visual tooling.

A dedicated CI job runs XML/path regression tests, regenerates and verifies the visuals, and requires a clean assets diff. Actions are commit-pinned and the job has read-only repository permissions.

Validation:

• MEASURED: 8 local security tests passed; 2 symlink tests were skipped because this Windows session lacks symlink privilege. Linux CI must run them before merge.
• MEASURED: Generation and verification passed for all 20 SVGs (60,644 bytes); the 20 assets and manifest match their canonical Git bytes exactly. The hardening changes no artwork.
• Reproducer: install scripts/requirements-readme-visuals.txt, run python -m unittest discover -s scripts/tests -p test_readme_visuals_xml.py, then both visual generation/verification scripts.
• Independent source review and git diff --check passed. Updated-head CI, including Semgrep and the new visual job, must pass before merge.

Preview: