docs: refresh README to match shipped rebalancer, safety, and governance

[jayeshy14]

The README had drifted behind main. It still described the CoW rebalancer as the next build and listed the safety layer and constituent governance as unbuilt, when all three are merged.

What changed

• Rebalancing rewritten from "not yet implemented" to the shipped system: frozen-target epochs, ERC-1271 delegated order validation, oracle-anchored minOut, the dual-threshold plus cap-trigger permissionless emergency, the buffer-aware target, quarantine-aware fresh-subset reweighting, and the mainnet-fork digest proof.
• New Safety layer section: constituent quarantine, NAV-per-share circuit breaker, guardian pause.
• New Constituent governance section: timelocked add, forced vs discretionary removal, wind-down-not-dump, guardian veto.
• Methodology now covers the cap trigger and the Nasdaq-style hysteresis.
• Trust model / limitations marks the rebalancer, safety layer, and governance as built-and-tested, and names the curator-managed yield layer and fee module as the planned next phase.
• Design decisions gained the "adding risk is gated, removing risk is open" principle; the outflow guarantee reflects the live rebalancer path.
• Repository layout now includes rebalancer/, governance/, GPv2Order.sol, and IRebalancer.sol.
• Build and test reflects the real 162-test suite and the mainnet-RPC requirement for the fork tests.
• Dropped the stale "autonomous" framing from the opener, since the project is steering toward curator management.

Docs only, no code changes.