docs(certification): add S6 security specialist module scaffold (#2369)

[bokelley]

Refs #2369

Adds the S6: Security specialist module page, specialist table row in docs/learning/overview.mdx, and nav entries in docs.json. The module page is marked as in-development via a Warning callout — no Addie wiring or sandbox exercises are included in this PR.

Non-breaking justification: new optional docs pages and nav entries; no schema, wire format, task definition, or Addie tool changes.

What's in scope

• docs/learning/specialist/security.mdx — full module page with learning objectives, specialism table (security, signed-requests), prerequisite reading cards, 7 lab exercises, assessment dimensions, connecting-to-test-agent block, and Warning that the module is in development
• docs/learning/overview.mdx — S6 row added to specialist table
• docs.json — docs/learning/specialist/security added in both nav version groups
• .changeset/s6-security-specialist-scaffold.md — empty changeset (docs-only, no protocol version bump)

What's deferred (follow-up to #2369)

• Addie teaching flow wiring (certification-tools.ts — begin_specialist_module enum, credential name map, module metadata)
• Sandbox exercises for idempotency, JWKS verification, and SSRF (requires sandbox infrastructure decision: dedicated sandbox vs. existing test kits)
• Criterion ID assignment for LOs 1–2 and LO 6 (conversational LOs that need a stable required-demonstration ID before Addie can grade them)

Nits surfaced in pre-PR review (not fixed — PR body only)

• S6 is listed at 60 min in overview.mdx while S1–S5 show 45 min. The issue spec says ~60 min and governance.mdx already says ~60 min in its callout while showing 45 min in the table — there's a pre-existing table vs. callout mismatch. Recommend correcting the overview table to 60 min for S4 and S6 in a follow-up pass.

Pre-PR review:

• code-reviewer: approved — broken idempotency link fixed, certification-tools.ts gap documented as deferred, docs.json updated in both nav locations
• docs-expert: approved — S4 overlap note added, specialism table added, sandbox auth block added, CTA replaced with in-development Warning

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See #3121
for context.

Session: https://claude.ai/code/session_01RXrSE3dZQ2Zu2mwZnN2JVM

---

Generated by Claude Code