Split capability navigation domains; canon 0.2.1 (OQ-2 resolved)

Security & Governance splits into `security` (secrets, keys, policy,
vulnerability) and `governance` (evidence, lifecycle). Every capability id
is unchanged — domains are navigation_only, so this is a table-of-contents
change, not a concept change.

- capabilities.yaml: 41 capabilities across 9 domains
- ITC-CAP §8 catalog table and promotion gate updated
- OQ-2 closed; decision record added to ASSIMILATION.md
- canon 0.2.0 -> 0.2.1 (patch) + CHANGELOG entry
- ITC-WP-0014 T01 done, workplan active

make validate: ok. make test: 22 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

infospace/models/capability/capabilities.yaml

@@ -14,7 +14,7 @@ canon:
   artifact_id: model/capability
   version: 0.1.0
   status: proposed
-  canon_version: 0.2.0
+  canon_version: 0.2.1
   purpose: Canonical, implementation-independent catalog of the abilities an information system may require
     or provide.
   normative_document: models/capability/InfoTechCanonCapabilityModel.md
@@ -665,7 +665,7 @@ domains:
     - availability_metrics
     typical_resource_classes: *id005
 - id: security
-  name: Security & Governance
+  name: Security
   navigation_only: true
   capabilities:
   - id: security.secrets
@@ -750,6 +750,10 @@ domains:
     - scan_results
     - remediation_records
     typical_resource_classes: *id006
+- id: governance
+  name: Governance
+  navigation_only: true
+  capabilities:
   - id: governance.evidence
     name: Compliance Evidence
     purpose: Produce and maintain evidence supporting governance, assurance, certification, or compliance