docs: post-release audit fixes — README, changelog placement, NFT doc, shutdown help (#587)

* docs: post-release audit fixes — README, changelog placement, NFT doc, shutdown help (0.10.0)

Post-v0.10.0 triple-check of repo-side docs surfaced:

- README: quick-reference still showed the removed 'coi shell
  --persistent' (self-contradicting the flag-removal note 200 lines up)
  and a bare 'coi persist' that errors without a container name;
  'Persistent mode (--persistent)' key-concept line; coi-default base
  said Ubuntu 22.04 (builder uses ubuntu:24.04); the migration callout
  still pointed at 0.9 — now points at the 0.9->0.10 wiki guide.
- CHANGELOG: PR #573's [[credentials]] entry had been merged into the
  0.9.0 (2026-06-17) section — a 0.9 reader would expect a feature
  their binary lacks. Moved to 0.10.0 New Features where it shipped.
- docs/NFT-MONITORING.md: sudoers drop-in named /etc/sudoers.d/coi in
  two places (real file is coi-nft — the doc's own setup snippet had it
  right); example rules used nonexistent per-rule 'priority -10/-5'
  tokens — rules are placed via 'nft insert' at the top of the FORWARD
  chain (only chains have priorities).
- coi shutdown --help still showed the removed --timeout=30 flag and a
  pre-rename claude-abc12345-1 container name; now shows the
  shutdown_timeout config key.
- Credential-catalog design doc status updated from 'ready for
  implementation planning' to shipped.

* ci: retrigger after unrelated auth-log monitoring flake (test_sudo_not_in_sudoers_triggers_high)