Document the Phase 9 security baseline

Add source-reviewed operational guidance, update acceptance and roadmap
references, consolidate agent state, and disable core dumps with silent
panic reboot defaults.

sdkconfig.defaults

@@ -16,7 +16,7 @@ CONFIG_ESP_WIFI_RX_BA_WIN=6
 CONFIG_LWIP_TCP_OOSEQ_MAX_PBUFS=4
 
 # Keep concurrent HTTPS handshakes from exhausting scarce internal DRAM.
-# Active TLS material remains unencrypted in PSRAM until the hardening phase.
+# Active TLS material remains unencrypted in PSRAM; physical extraction is outside scope.
 CONFIG_MBEDTLS_EXTERNAL_MEM_ALLOC=y
 # CONFIG_MBEDTLS_INTERNAL_MEM_ALLOC is not set
 # Hardware AES can hang in the PSRAM DMA path and cannot be shared safely with
@@ -72,3 +72,8 @@ CONFIG_ESP_WIFI_SOFTAP_SAE_SUPPORT=y
 
 # Keep diagnostic and interactive-console logging concise but useful.
 CONFIG_LOG_DEFAULT_LEVEL_INFO=y
+
+# Intermittent-use baseline: avoid secret-bearing crash dumps/register output.
+# Ordinary logging remains enabled; this is not physical-memory protection.
+CONFIG_ESP_COREDUMP_ENABLE_TO_NONE=y
+CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT=y