Refresh and expand the documentation set

[GaryJones]

Summary

Started as a one-line fix — the README's changelog link still pointed at trunk — and grew into a wider review of how the documentation serves the audiences who interact with this plugin. Three were notably underserved: theme developers wanting more than four template-tag signatures, plugin authors looking for hooks that aren't zoninator_zone_lock_period, and headless integrators wondering how the REST API behaves now that GET /zones requires authentication.

The README previously tried to address all of those audiences in one short page and didn't really succeed for any of them. It now sticks to what WordPress.org renders well — overview, installation, FAQ, upgrade notice, screenshots — and links out to a new docs/ folder for deeper material. The audience-specific guides (theme developers, hooks reference, REST API) live there, with the hooks reference covering all ~50 plugin hooks and the REST guide documenting every route under zoninator/v1, including the zoninator_rest_get_zones_permissions_check escape hatch introduced in 0.11.0.

SECURITY.md and CONTRIBUTING.md fill gaps that became conspicuous after the 0.11.0 security release. Researchers had no signposted disclosure route — SECURITY.md now points at HackerOne, mirroring Edit Flow's pattern. New contributors had to reverse-engineer process from AGENTS.md (which is written for LLMs) — CONTRIBUTING.md now covers bug-report expectations, local wp-env setup, and the public-API contract.

While auditing, two existing files turned out to be wrong: AGENTS.md still claimed version 0.8.0 and missed several composer scripts and the vendored Mixtape REST framework, and tests/README.md documented composer prepare-ci and composer test commands that don't exist. Both are now accurate.

.distignore excludes the new GitHub-only docs (docs/, CONTRIBUTING.md, SECURITY.md) so the WordPress.org SVN package stays lean. The README links to those docs at absolute GitHub URLs so they resolve from both the GitHub repository view and the WordPress.org listing.

Test plan

• Read through the new docs/ files end-to-end and sanity-check the hook signatures and REST descriptions against the source.
• Render the README on GitHub and confirm all five documentation links resolve.
• Confirm the .distignore additions exclude the right files (next deploy will be the real test).