[Security] Freeze Shared threat model

[yutthaphon]

Problem

Shared trust boundaries, hostile inputs, credentials, plugins, transfer, and recovery controls require approval.

Change

Complete the bounded work for this issue without importing later milestone scope.

Behavior

Before: The required capability, decision, or evidence is incomplete.
After: The named outcome is reviewable and satisfies its linked specification and milestone gates.

Acceptance

• Dependencies and stable IDs are linked.
• Observable acceptance evidence is recorded.
• Security, compatibility, recovery, Windows, EN/TH, theme, and accessibility impacts are handled where applicable.
• No local Plan/ file is uploaded.