[MotherSphere]

README and docs catch up with what MemoryStick is today.

What changed

• Status: says MemoryStick is released. Since v0.1.0 every release is built in CI from a release-please tag, signed by the Project-Colony organisation and verified by Colony. It lists what CI proves (Rust tests on Linux, Windows and macOS and on Rust 1.90; the release workflow's --version check and the Intel macOS architecture check) and what is still checked by hand (the window, Preferences, themes, French). No next version is named.
• Code signing policy: replaced with the section from Resources templates/program/README.md: the .sig / .meta / .meta.sig table, the key-never-in-build-jobs paragraph, the OpenSSL check with the organisation key and a=memorystick-linux, and the design/releases.md link. The SignPath "Free code signing provided by SignPath.io" line and the roles now live only in the template's HTML comment, since signpath-project-slug is still commented out in release.yml and the .exe carries no Authenticode signature yet.
• Privacy: ### Privacy policy becomes a top-level ## Privacy after the signing policy, in the template's table shape: preferences file per OS, the web view folder (private mode), the opened document and its images (read, never stored). New row: the system Open dialog may add the picked file to the OS recent files list (Windows recent items, GTK recently-used.xbel on Linux; rfd 0.16 uses the GTK backend here), which MemoryStick does not control. The existing true statements stay (no network from documents, links only on click, no scripts or frames from documents, the web view's vendor policy). It ends with the no-transfer sentence SignPath Foundation accepts.
• docs/third-party-notices.md: one paragraph on why Mermaid is held on 11.x: Mermaid 12 depends on elkjs ^0.9.3, EPL-2.0 only, incompatible with GPL-3.0-or-later; lift the hold once Mermaid depends on elkjs 0.12 or later (EPL-2.0 OR GPL-3.0-or-later).
• Documentation section keeps its flat docs/ links (two pages).

How it was verified

• Ran the README's OpenSSL commands against the published v0.1.0 memorystick-linux: both signatures verify, and the .meta reads version=v0.1.0, asset=memorystick-linux with the asset's sha256.
• Checked every privacy claim against the code on main: preferences.rs (config_local_dir()/Colony/MemoryStick/preferences/preferences.json, cache webview folder, cache\ on Windows, none chosen on macOS), main.rs (.incognito(true)), document.rs (the six extensions, 32 MiB cap, the nine image types, folder-tree and network-share refusal), Cargo.lock (rfd depends on gtk-sys).
• Checked the Status against .github/workflows/ci.yml (3 OS test matrix, MSRV job reading rust-version = "1.90") and release.yml (--version smoke test, file | grep x86_64 on the Intel macOS leg).
• Checked the Mermaid facts with npm: mermaid@12.1.0 depends on elkjs ^0.9.3; elkjs 0.11.1 is EPL-2.0, 0.12.0 is EPL-2.0 OR GPL-3.0-or-later.
• Re-checked the README's paths, build command and shortcuts against current main (src-tauri/, dist/, Ctrl+O/D/R, F5, Escape). The layout flatten has not landed yet; the PR that moves to src/ and src/ui/ updates those paths in the same change.
• No em or en dashes in the changed files.