Split capability navigation domains; canon 0.2.1 (OQ-2 resolved)

Security & Governance splits into `security` (secrets, keys, policy,
vulnerability) and `governance` (evidence, lifecycle). Every capability id
is unchanged — domains are navigation_only, so this is a table-of-contents
change, not a concept change.

- capabilities.yaml: 41 capabilities across 9 domains
- ITC-CAP §8 catalog table and promotion gate updated
- OQ-2 closed; decision record added to ASSIMILATION.md
- canon 0.2.0 -> 0.2.1 (patch) + CHANGELOG entry
- ITC-WP-0014 T01 done, workplan active

make validate: ok. make test: 22 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/index.yaml

@@ -195,7 +195,7 @@ workplans:
 
   - id: ITC-WP-0014
     title: Capability Model consolidation (post-ITCC assimilation)
-    status: proposed
+    status: active
     priority: medium
     path: workplans/ITC-WP-0014-capability-model-consolidation.md
     depends_on: