Publish threat model and refresh native v1 docs

Add docs/THREAT_MODEL.md deriving a publishable threat model from
NATIVE_V1_SPEC.md sections 4-6: assets, in/out-of-scope attackers,
security properties vs SSH (including where Dosh aims to exceed it),
cryptographic building blocks as implemented, and an honest
accepted-residual-risks / known-gaps section.

Refresh docs/PUBLIC_READINESS.md: feature matrix now reflects native
auth, host-key trust, authorized_keys policy, doctor, and -L/-R/-D
forwarding; add a per-item "Native v1 verification checklist status"
table mapping spec section 16 to done/in-progress/pending from code.

Update README.md status with a native v1 section and honest claim
posture pointing to THREAT_MODEL.md. Annotate NATIVE_V1_SPEC.md with a
v1 status block summarizing milestone progress. Point SPEC.md security
model and header at native auth and the threat model.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

SPEC.md

@@ -4,7 +4,8 @@
 **Default language:** Rust, unless benchmarks prove the stack is the bottleneck  
 **Binaries:** `dosh-server`, `dosh-client`, `dosh-auth`, `dosh-bench`  
 **Helper mode:** `dosh-server auth` or `~/.local/bin/dosh-auth`, invoked by SSH with `-T`  
-**Native v1 plan:** `docs/NATIVE_V1_SPEC.md`
+**Native v1 plan:** `docs/NATIVE_V1_SPEC.md` (substantially implemented; see its v1 status block)  
+**Threat model:** `docs/THREAT_MODEL.md`
 
 ---
 
@@ -157,8 +158,11 @@ owner per session is preferred. Cross-thread designs are allowed only if benchma
 
 ## 7. Security Model
 
-SSH is the first trust root. dosh does not implement a competing public-key login
-system in v0.
+SSH is the first trust root and the recovery/bootstrap fallback. The v0 core relies
+on SSH for first authentication. Native v1 (`docs/NATIVE_V1_SPEC.md`) adds an opt-in
+native public-key login over the Dosh UDP transport that is tried before SSH, with
+its assets, attackers, and residual risks documented in `docs/THREAT_MODEL.md`. SSH
+remains the explicit fallback and the host-key trust bootstrap path.
 
 The UDP channel uses AEAD. Recommended default: `ChaCha20-Poly1305` for portable
 speed, with `AES-GCM` allowed when hardware acceleration is known to be available.