Split capability navigation domains; canon 0.2.1 (OQ-2 resolved)

Security & Governance splits into `security` (secrets, keys, policy,
vulnerability) and `governance` (evidence, lifecycle). Every capability id
is unchanged — domains are navigation_only, so this is a table-of-contents
change, not a concept change.

- capabilities.yaml: 41 capabilities across 9 domains
- ITC-CAP §8 catalog table and promotion gate updated
- OQ-2 closed; decision record added to ASSIMILATION.md
- canon 0.2.0 -> 0.2.1 (patch) + CHANGELOG entry
- ITC-WP-0014 T01 done, workplan active

make validate: ok. make test: 22 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

canon.yaml

@@ -1,7 +1,7 @@
 repository: info-tech-canon
 title: InfoTechCanon
 status: service-baseline
-version: 0.2.0
+version: 0.2.1
 description: >
   An evolving, markdown-first canon for building interoperable, adaptable,
   and extensible information-processing systems.
@@ -170,4 +170,4 @@ next_actions:
   - implement ITC-WP-0003 validation and generated views
   - implement ITC-WP-0004 small-saas profile proof
   - explore ITC-WP-0006 PURPOSES model extension
-  - resolve ITC-WP-0014 T01 capability identifier prefix (blocks ITC-CAP promotion)
+  - publish ITC-WP-0014 T02 capability.schema.yaml (next ITC-CAP promotion gate)