docs: inter-canister calls security guide (#79)

## Summary

- Explains why inter-canister calls are dangerous: separate atomic
message executions and state interleaving at await points
- CallerGuard reentrancy protection in Rust (Drop trait) and Motoko
(finally block) with complete code examples
- State mutation ordering: deduct before await, compensate on failure in
callback
- Callback trap safety and security-critical cleanup patterns
- Bounded vs unbounded wait tradeoffs; response size limits (2 MB) and
pagination
- Caller identity capture across await points;
`canister_inspect_message` not called for inter-canister calls
- All code verified against dfinity/cdk-rs
(Call::bounded_wait/unbounded_wait API)

## Sync recommendation

informed by dfinity/icskills — canister-security skill, multi-canister
skill; dfinity/cdk-rs — ic-cdk/src/call.rs

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: marc0olo