Security: add MITRE ATLAS candidate mappings for agent identity/payment attacks

[pshkv]

Summary

• add candidate MITRE ATLAS mappings for Agent Identity Spoofing and Agent Payment Hijacking
• include machine-readable candidate YAML with claim boundaries and evidence references
• create a Gmail draft for manual submission to atlas@mitre.org
• link the mappings from README and docs navigation

Source check

• MITRE ATLAS data repo currently documents v6 distribution shape and AML.T#### ID conventions
• canonical IDs for the two candidate techniques are still treated as pending here

Validation

• pnpm run docs:build
• git diff --check

Refs #127