Add classification guide; fix RFC misdirection; document advisory boundaries

[kurtseifried]

Brings SecID's classification procedure into SecID, so the definitions, the decision process, and the boundaries all live with the types they describe.

Why

The procedure already existed — as PROMPT-CLASSIFICATION.md in dataset-public-laws-regulations-standards. Three problems: it lives in a repo SecID 2.0 retires, it's scoped to documents rather than SecID material generally, and it states a load-bearing rule that appears nowhere in SecID — "reference/ is the catch-all, use it whenever in doubt."

That last point matters. The heterogeneity of reference (identifier systems, format specs, glossaries, papers, courses) isn't drift — it's documented policy working as designed. But the policy lived only in a downstream consumer, so anyone reasoning from SecID alone would read it as decay.

Classification also has to be reproducible, for the same reason extraction does (ADR-012): the same source handed to a different person or AI session two years from now must land in the same place. A wrong classification still resolves — it just resolves somewhere nobody looks.

docs/guides/CLASSIFY.md (new)

Four steps (type → subtype → namespace → name/version/subpath), boundary tests, worked examples, edge cases, when to stop and ask, and a gap-detection section.

Two rules stated explicitly for the first time:

• reference is the catch-all, by design. With the consequence spelled out, so it reads as policy rather than decay.
• Publisher packaging beats object ontology. ATT&CK ships groups, software, and mitigations inside a TTP framework, so all of them live under ttp even though a group is really an organization. Splitting a publisher's framework across four SecID types to satisfy an ontology would make every reference harder to build and verify.

The boundary table defers to the type files rather than restating them — methodology.md's duck test ("what do I DO with it?") and capability.md's MUST/IS/CAN verb test are sharper than any summary, so the guide points at them.

Bug fix: registry/reference.md misdirected RFCs

It told contributors IETF RFCs belong at secid:control/ietf.org/.... That namespace does not exist. RFCs actually live in reference/org/ietf.json (pattern ^\d+$), and CLAUDE.md's type table already said so — the two docs contradicted each other. Corrected to: RFCs are reference by default, with methodology/ietf.org/rfc-3227 as the genuine exception where an RFC defines a process.

registry/advisory.md — boundary section added

The only type file with none. Adds Advisory vs Weakness vs Reference (specificity plus event-hood), and notes that incident reports are advisory + subtype: ["incident"].

Gap detection

A catalog of what exists cannot show what's missing. The guide adds the five-question frame — what exists / what ought to be true / what do I run / what was found / where is it written — where two columns are currently empty. That's the mechanism that surfaced the executable and evidential gaps, confirmed independently by mapping STIX (which leaves exactly Indicator, Malware Analysis, and Opinion homeless).

Docs-only. No registry JSON touched, no deploy-chain impact. All relative links verified.