docs: add defensive security blueprints

[executors132-a11y]

Why

Add Polish-language defensive guidance without expanding the repository's production or offensive capabilities. The documentation defines a hardened ephemeral host model and a transparent Telegram/Telethon assistant model suitable for alert triage and audited operations.

What changed

• Added BLUEPRINT-EPHEMERAL-OS.md covering Secure Boot, measured boot, TPM attestation, integrity checks, RAM/tmpfs handling, SSH hardening, centralized logging, audit, incident response, recovery, and readiness tests.
• Added docs/ai-group-assistant-plan.md covering a least-privilege, auditable Telegram/Telethon assistant with allowlists, redaction, explicit approval, idempotency, human-in-the-loop controls, monitoring, and recovery.
• Both documents explicitly exclude C2, evasion, hidden persistence, reverse shell, port knocking, exfiltration, Shadow Agent, and self-erasure.

Validation

• git diff --check -- BLUEPRINT-EPHEMERAL-OS.md docs\\ai-group-assistant-plan.md passes.
• No production code or dependency files were changed.

Review notes

The working tree contains an unrelated pre-existing modification to start.py; it was intentionally not included in this commit or PR.