README + COMPLIANCE currency; correct npm publish status; drop internal-spec name leaks

[styk-tv]

README pinned stale OCI versions (:1.4.3 / :1.5.0) and implied the 1.5.x client was on npm; COMPLIANCE was dated to an older surface and named internal-only spec files.

• README: pin :1.5.2; correct npm status (legacy 1.0.0 is the only published version; modern client via OCI; npm publish imminent).
• COMPLIANCE: refresh to the current dispatch-only surface; remove internal-spec filename references (reference the substrate by public surface).
• PROVENANCE: add a cross-repo public-disclosure policy section.

State: implemented, staged for the v1.5.3 commit.

[styk-tv]

Closing statement. Delivered in 296296b, shipped in v1.5.3 (attested). README and COMPLIANCE are version-current; the npm publish status is now stated truthfully — the package is staged in package.json but publishing is deferred (tracked in #3/#4); internal-spec name references are gone from both documents.

Where each answer lives now: LATEST.md = what is published (auto-written by CI, attestation-gated — never hand-edited); README.md = the CK API surface; COMPLIANCE.md = the transport contract vs pgCK; CHANGELOG.md = per-version history with terminal attestation status; PROVENANCE.md = release rules + disclosure policy.