Close final Hebrus documentation gaps

[andreaborio]

What changed

• repoint canonical citation, security, issue-template, migration, and reference links to andreaborio/hebrus
• mark the administrative rename complete in the compatibility contract
• retain DS4 only where it is serialized, historical, upstream attribution, or artifact compatibility

Why

The final rebrand audit found public documentation that still described the old repository identity as current.

Validation

• make premerge
• git diff --check