Adds the load-bearing prose statement for the strict-PQ chain-profile
gate landed in luxfi/threshold (commit b1218f3). Documents:
* Two canonical Combine paths (legacy-compat strict-atom vs strict-PQ
TEE-attested) and the residency-window tradeoff that distinguishes
them.
* The single-function profile gate (`magnetarRefuseUnderStrictPQ`)
mirroring the precompile-side `contract.RefuseUnderStrictPQ`.
* The t-of-n attested-combiner pool's freshness gate (RotationWindow),
quorum semantics (Threshold>=2), and byte-equality discipline (no
silent winner-picking on divergence).
* Production attestation kinds: SEV-SNP is the only production-ready
cc/attest verifier today; TDX + NRAS are stubs (lux/mpc#222 stages
2-3) admitted by the pool's `KnownIssuers` once shipped.
* Adversary model (commodity-host vs strict-PQ) and why strict-PQ
closes the microsecond residency window fully for institutional
custody.
Cross-referenced from BLOCKERS.md's strict-atom closure block.
