docs: refresh README with new diagrams, comparison and attack use-cases

The README described what KubeArmor is, but not the one thing that
separates it from every detect-and-respond engine: the decision happens
at an LSM hook, in kernel space, before the syscall completes.

Changes:

- Replace the static architecture PNG with a new SVG that colours the
  enforcement path separately from the telemetry path.
- Add "Where the decision happens", a two-timeline figure comparing
  inline enforcement against detect-and-respond.
- Add a comparison table for 7 runtime security engines across inline
  blocking, allow-list policy, sandboxing, hardened distro support and
  overhead, sourced from the 2025 comparative paper.
- Add five published 2025 campaigns (React2Shell, Shai-Hulud,
  IngressNightmare, Dero miner, nullifAI) with the policy control that
  breaks each chain, plus a figure showing the shared attack chain.
- Add an agent sandboxing section for ModelArmor, with the four risks
  and the four policy controls that answer them.
- Add an install snippet. The README had none.
- Add measured performance numbers, labelled with their date and
  release line.
- Convert the governance bullet list into a table.

All four figures are hand-authored SVG in .gitbook/assets/diagrams/,
with a fixed light palette so GitHub dark mode readers see the same
drawing. No build step, no external requests, no new dependencies.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: HighnessAtharva