docs: sync governance and validation with hardening pass

Update contributor, security, validation, and compute handoff documentation to reflect new runtime safeguards, CI gates, and expected regression checks.

Made-with: Cursor

CONTRIBUTING.md

@@ -33,6 +33,8 @@ The API expects `solver-c/solver_main` and `solver-c/solver_fea_main` in the rep
 
 ```bash
 make test
+make test-solver-sanitize
+cd gui-ts && npm run build
 ```
 
 This runs `solver-api` Vitest, `gui-ts` Vitest, and `solver-c/test_solver`.
@@ -42,6 +44,7 @@ This runs `solver-api` Vitest, `gui-ts` Vitest, and `solver-c/test_solver`.
 - Keep changes focused; avoid drive-by refactors.
 - If you change solver equations or boundary conditions, update [Agents/MATH_SPEC.md](Agents/MATH_SPEC.md) and the gap table in [Agents/COMPUTE_PLAN.md](Agents/COMPUTE_PLAN.md).
 - If you change the JSON contract or HTTP responses, bump `schemaVersion` only with an explicit migration plan (see [AGENTS.md](AGENTS.md)).
+- Keep golden response behavior deterministic; only update `data/golden/default.solve.sha256` when output changes are intentional and documented.
 
 ## Coding style