PB-010: Security and network docs match the shipped app

State: Proposed. Not approved for implementation. Priority: P1 (mandatory: required). Owner when approved: Master product (unassigned).

1. PR title and ID#

Bring the security model and network host list up to date (PB-010)

2. Business problem#

Security reviewers and firewall teams act on docs/security.md and docs/enterprise-install.md. Both understate what is built and the host list is incomplete, which either blocks deployment (missing hosts) or makes the app look less secure than it is.

3. Current verified behavior#

docs/security.md line 41 says "Open: no redaction yet"; sidecar/fabric_desktop/redact.py redacts every engine error and Report a problem, tested by sidecar/tests/test_redact.py (passed in this assessment).
docs/security.md line 51 says there is not yet vulnerability scanning, an SBOM, build provenance or SHA-pinned actions. .github/workflows/ci.yml has pip-audit, cargo audit, CycloneDX SBOMs (sbom-app, sbom-engine), actions/attest-build-provenance and SHA-pinned actions.
docs/enterprise-install.md hosts table (lines 78-84) attributes api.powerbi.com to semantic models; the code uses it to add workspace users (estate_service.py). It omits onelake.table.fabric.microsoft.com, analysis.windows.net (token audience), storage.azure.com, vault.azure.net and any host the embedded Fabric view loads.

4. Desired behavior#

Every statement in both pages is true of main at the time of the PR, and the host list is derived from the code with a short note per host.

5. In scope and out of scope#

In scope: docs/security.md threat table and supply chain section; docs/enterprise-install.md hosts table; a script or test that lists hosts found in the code.

Out of scope: changing any behavior; user-guide fixes (PB-077).

6. Architecture and files#

docs/security.md, docs/enterprise-install.md.
Optional sidecar/tests/test_docs_hosts.py: fails when a https:// host in sidecar/fabric_desktop or app/src-tauri/src is missing from the hosts table (allow-list for documentation-only links).

7. Functional requirements#

Redaction, scanning, SBOMs, provenance and pinning described as in place with links to the code.
Remaining open items (tag-pinned actions in docs.yml and codex-review.yml, unencrypted token cache, no CSP) stated as open.
Each host lists the feature that needs it and whether it is needed after install.

8. Nonfunctional requirements#

Plain language for IT readers; no marketing claims.

9. Dependencies#

None.

10. Security and compatibility#

Docs only. Must not overstate: anything unverified on a tenant says so.

11. Acceptance criteria#

Reviewer checks each security.md row against the cited file.
The hosts test (if added) passes and fails when a host is removed from the table.
zensical build passes in strict mode.

12. Unit and integration tests#

The optional hosts test; otherwise none.

13. Manual verification#

Grep the code for https:// hosts and compare with the table.

14. Documentation#

This PR is the documentation.

15. Rollback#

Revert the commit.

16. Definition of Done#

Merged, docs build green, FEAT-SEC-03 limitation about stale docs removed in the inventory.