Add draft FMSG-009 witnessed checkpoint standard

[markmnl]

Adds an optional auditing standard for committing fmsg message hashes to a Merkle log and retaining independently witnessed evidence against later replacement of that history. The standard defines the log-to-message binding, proof API, witness trust policy, and evidence needed for historical verification.

It uses the existing C2SP checkpoint, signed-note, timestamped cosignature, and HTTPS witness protocols. Witness operations do not generate fmsg messages, avoiding a cycle in which checkpoint traffic creates more checkpoints. The draft stands independently of message signing and defers inclusion promises.

Verification claims are limited to a particular hash's commitment under the configured witness and clock assumptions. Missing proofs are distinguished from evidence of inconsistent log statements; completeness, delivery, authorship, and continued message storage are outside the guarantee.

Adds the standard to the standards index and site navigation. This PR contains documentation only and is based directly on main.

Validation:

• Production documentation build passes in strict mode from a clean snapshot of the staged files.
• Local references validated in 16 HTML pages.
• git diff --check passes.
• Checkpoint and witness formats reviewed against the pinned C2SP specifications.