docs(knowledge): refresh mds-js, mds-lint, source-map-security KBs after #335

[dean0x]

Refreshes the three feature knowledge bases made stale by the v0.4.0 dogfooding remediation (#335):

• mds-js — LintDiagnostic contract updated: help/span/fix_edits are now REQUIRED keys typed | null (the previously documented optional-key decision was reversed by v0.4.0 dogfooding remediation: full defect sweep before tagging #335 J2).
• mds-lint — preview pipeline now residual-based (PreviewOutcome::WouldFix { fixed, residual }, exit = max(1, residual severity)); exit-code table gains the mds::var_conflict carve-out (exit 1 on lint) and mds::module_not_found; two-variant @include empty-output warning documented.
• source-map-security — R3 display-path architecture (display_path_for, ModuleCtx key/display split, Origin.display, MapBuilder display_names, ADR-005 byte-identity) and the TS mirror in bundler-utils project-root.ts including stripWindowsVerbatimPrefix (the Windows verbatim-path lesson, JS edition).

Docs only — no code changes. Content verified against main at 0cd08d6.