chore(maintenance): clarify runtime device contract and documentation index

[masarray]

Purpose

Start a bounded maintainability pass without changing the accepted v1.6.40 IEC 61850 behavior. Tracks #380.

Exact baseline and change scope

• Base: main at 9d081f54fc6466d13c099e8a94a020c487a36703.
• Commit: dc07b3f06fde71eb8f8370681f920850edd2eb8a.
• Services/UiResponsiveIec61850MonitorRuntimeFacade.cs: use the required non-null device.DeviceId in five UI-to-runtime calls, rather than device?.DeviceId which unnecessarily marks the same device nullable at the delegated call.
• docs/README.md: link to canonical VERSION and published GitHub Release rather than maintaining a stale copy of the source version; repair two audit links to their actual docs/audits/ paths.
• CONTRIBUTING.md: point maintenance/refactoring contributions to the existing AGENTS.md contract; do not introduce another policy document.

Preserved contracts

No change to Discovery, canonical model, SCL exporter, RCB selection, static DataSet report-only authority, GI, process polling, control lifecycle, engine locks, release pipeline, or published v1.6.40 assets. The five method signatures already declare device non-null; there is no behavior change for valid calls. The contract for invalid null calls may now fail at argument access rather than later in the operation, so this is not represented as strict equivalence for unsupported inputs.

Validation / review

• Compared the actual commit with the exact base: three files, one commit, no other changes.
• Verified the two replacement documentation targets and VERSION on main.
• Exact-head CI completed: 8/8 workflows passed at dc07b3f06fde71eb8f8370681f920850edd2eb8a, including Build ARSAS and Smart Discovery Field Capture Build. The Merge Execution Guard logged 1,315 passed, 0 failed, 0 skipped. The remaining CS8601 warnings are two separate locations in trusted-SCL static reporting, outside this PR.
• No local Windows executable/physical IED validation performed or needed for this scoped maintenance change.
• Check contributor DCO/sign-off compliance and exact-head CI before merge. No auto-merge.

Follow-up, not included

A separate ownership/dependency map and one-subsystem-at-a-time consolidation. Do not combine with open SCL parity PR #374.

[masarray]

Combined with #414 and #415 in draft integration PR #416 (#416). The 8-file combined candidate at c37bec2c20f99077d8b6b4b2d38ebcc55896e2c9 passed 9/9 workflows, including 1,315 ARSAS regression tests. Keep this source PR open for traceability; do not merge independently if #416 is selected as the signed-off integration vehicle. Close as superseded only after the accepted integration is actually merged.