refactor(security): contract SecurityConfig and Arc Deref shell

[foxzool]

Parent

#425

What to build

删除 SecurityConfig 镜像和 Arc/Deref 浅壳，以 canonical Config 和明确 Security client interface 完成 v0.18 收口。

Acceptance criteria

• SecurityConfig 与 field-by-field Config 转换已移除
• Arc/Deref-only shell 已删除或由有真实深度的 client 取代
• CHANGELOG 提供 v0.18 direct-construction 迁移说明
• root/client、security crate、全 feature test、clippy 和 doc 通过

Blocked by

• refactor(security): migrate ACS to retained canonical Config #445
• refactor(security): migrate compliance domains to retained Config #446