spec(v4): promote R4-P0-1 user.klickd onboarding wizard to normative (docs-only)

[Davincc77]

Summary

• Promote SPEC §33 R4-P0-1 preview wording toward normative RFC 2119 language for the user.klickd 7-step onboarding wizard with mandatory reload verification (step 6, non-negotiable).
• Add the new normative companion document docs/spec/R4-P0-1-onboarding-wizard.md and a pointer section SPEC.md §33.11 linking to it.
• Update docs/roadmap/ROAD-TO-V4-GA.md R4-P0-1 entry to reference the normative contract as a deliverable now landed.

This PR is strictly docs-only and scope-limited to R4-P0-1. No SDK / schema / vector / wire-format / package / npm / PyPI / Zenodo / DOI / Git tag / GitHub release change is implied or required.

Scope (in / out)

In scope (R4-P0-1 only):

• RFC 2119 normative contract for the seven-step user.klickd wizard (steps 1–7).
• Step 6 (reload verification) explicitly MUST, non-skippable, non-deferrable.
• Step 4 passphrase contract: confirmation required, no off-device transmission, memory-bounded.
• Cross-cutting conformance: no raw payload exposure, no network call required, unknown-field preservation per §33.7.

Out of scope (explicitly listed in §5 of the new doc):

• user.klickd strict schema → P0-2.
• SDK alignment → P0-3 (Python) / P0-4 (TypeScript).
• Vectors → P0-6.
• KLICKD_E_* i18n error table → R4-P0-2 (referenced as a next step, not implemented here).
• QR / deeplink trigger → P1 conditional / P2, governed by docs/ux/V4-ONBOARDING-QR-DEEPLINK.md.
• media.klickd / project.klickd / gaming.klickd / agent.klickd / core.klickd profiles → respective RFC tracks; MUST NOT enter the user.klickd main path.
• Any package version bump, Git tag, GitHub release, or DOI mint.

UX constraints preserved

• user.klickd = simple step-by-step explanatory main path (this PR).
• <x>.klickd = advanced progressive disclosure (kept on separate entry, untouched).
• QR / deeplink NOT V4 P0 (governance preserved per docs/ux/V4-ONBOARDING-QR-DEEPLINK.md).
• Media / project continuity & gaming baseline = V4 but out of this P0-1 PR (only referenced as out-of-scope / future work).
• §33.7 forward-compatibility contract and §33.10 privacy invariants unchanged.

Files changed

• NEW: docs/spec/R4-P0-1-onboarding-wizard.md — RFC 2119 normative contract, 7 steps + cross-cutting conformance + non-goals.
• SPEC.md — new sub-section §33.11 pointing to the normative companion (no change to §33.1–§33.10 normative behavior, no field-surface change).
• docs/roadmap/ROAD-TO-V4-GA.md — R4-P0-1 entry updated to reference the normative deliverable as landed.

Testing

• python verify_vectors.py → 59/59 PASS (0 failed)
• node verify_vectors.mjs → 29/29 PASS (0 failed, 13 skipped without hash-wasm, per CONTRIBUTING.md)
• Docs-only diff — no executable / schema / vector / SDK file touched (verified via git diff --stat)
• git grep confirms no new package version, no new tag, no new release artefact references introduced
• All cross-references resolve (roadmap → spec, spec → roadmap, SPEC §33.11 → docs/spec)

Next recommended branch after this PR

Per §7 of the new normative doc and roadmap §2.4: R4-P0-2 — KLICKD_E_* i18n error table (FR/EN/DE/LB) — because R4-P0-1 already depends on it for step 4 (passphrase confirmation failure) and step 6 (reload verification failure) error contracts. R4-P0-2 is docs-only and unblocks the wizard's error contract without touching SDK, schema, or vectors.

🤖 Generated with Claude Code