Promote incident reports to named advisory subtype

[kurtseifried]

Summary

Wires up the `advisory + ["incident"]` subtype on the SecID side after SecID-Service PR #12 declared the value in the canonical `type-registry.ts`. Bundles a CLAUDE.md WARNING-block accuracy fix surfaced by the audit that preceded this work.

Changes

Documentation:

• `docs/reference/TYPES-AND-SUBTYPES.md` — new `### advisory` section under "Named subtypes in use today"; advisory row removed from "Implicit overloads" with a forward-pointer note.
• `CLAUDE.md` — SecID Types table row for advisory now reflects the tagged status; WARNING block corrected (4 inaccuracies: wrong file name for SecID-Service, missing schema enum, missing `registry_loader.py`, client-SDK clarification).

Registry tagging (5 source-level match_nodes across 4 files; no backfill sweep):

• `registry/advisory/gov/nhtsa.json` — SGO match_node only. `av-recalls` and `odi` stay untagged (advisories, not incidents).
• `registry/advisory/org/aiaaic.json` — AIAAIC Repository (sole match_node).
• `registry/advisory/gov/ca/dmv.json` — `av-collision` + `av-disengagement`. `av-permits` stays untagged (permit records).
• `registry/advisory/org/partnershiponai.json` — AIID (sole match_node).

Test plan

• `python3 scripts/validate-subtypes.py` — passes; 49 usages across 12 distinct (type, value) pairs including `advisory + incident`.
• All 4 modified JSON files parse cleanly.
• SecID-Service `/api/v1/types` returns `incident` under advisory's `subtypes` array (already verified live).
• After merge: the registry-KV-upload chain will sync the tagged values to KV; `?subtype=incident` filtering will then return the tagged namespaces.

Out of scope

• Tagging existing non-incident namespaces under control's `benchmark` / `documentation-standard` patterns (still in "Implicit overloads").
• Adding new incident-source namespaces (e.g., FDA MAUDE, OECD AIM) — future work.

🤖 Generated with Claude Code