docs: v5.2.0 — extract and formally reference every TC18 SHOULD/MAY clause

[SoundMatt]

Summary

• Mirrors c-RCP's and cpp-RCP's own identical SHOULD/MAY audits (their PRs #162, [rust-RCP-08] ROADMAP.md's own Compliance Targets table contradicts its milestone checklist and CHANGELOG #105).
• All 51 non-legal SHOULD (10) / MAY (41) occurrences in TC18 individually classified.
• 7 already-implemented optional capabilities got a real tc18 citation added to their existing requirement entry: REQ-PWR-001, REQ-LIFE-001, REQ-SPI-005, REQ-ADC-007, REQ-TRIG-001, REQ-SEQ-001, REQ-SAFEMEAS-001. This crate had 0/608 requirements citing TC18 before this pass.
• The non-testable lines are individually cited in new docs/TC18-NON-NORMATIVE-CLAUSES.md.
• Honestly flags 4 MAY-described capabilities as genuinely uncertain rather than papering over them with a citation. Most notably: REQ-TIME-002/REQ-TIME-003's Timed-request readiness check uses AvtpTimestamp (32-bit, ~4.3s rollover) for what TC18 §11.2.2.5 defines as a 48-bit, 3.25-day-rollover presentation_time — the same class of time-domain conflation bug found and fixed this session in go-RCP's conditional-request envelopes. Not fixed here — recorded for its own dedicated investigation, not silently resolved with a citation.
• No code behavior changed. A fuller MUST-clause citation backfill remains separate, larger, future work.

Test plan

• .fusa-reqs.json valid JSON, surgical diff
• cargo build --release: clean
• cargo test --release: 1107+32 tests passed, 0 failed
• rsfusa check (fresh v0.3.17 build matching CI's exact pin): 0 errors
• rsfusa trace --req-coverage 100: gate passed