docs: onboarding golden-path docs + agent config reference (bd openlock-lvc.4, lvc.5)

[vessux]

Closes the onboarding golden-path epic (openlock-lvc) — the discovery half: human docs (lvc.4) + an agent-facing config reference (lvc.5).

What changed

• Repo reorg: docs/ is now tracked/public; local-only artifacts (spikes, recipes, superpowers specs/plans) moved to a gitignored .local/. (.gitignore flip only — CLAUDE.md is locally git-excluded by design, so its preference note isn't in the diff.)
• README slimmed 342 → 141 lines into a golden-path landing: install → doctor → init → validate → sandbox, with an accurate command cheatsheet and links into docs/.
• New docs/ reference pages: installation, sessions, mounts, policies, security, plus a docs/README.md index — the dense prose moved out of the README.
• New docs/agent-config-reference.md (harness-agnostic, machine-loadable: full .openlock config + policy schema, internals, and a {harness, provider, project files} → config decision procedure) + a thin root llms.txt index.
• Drift guard: config-core now exports knownConfigTokens(); src/agent-reference-drift.test.ts asserts the agent reference documents every config key/enum the validators recognize (55/55). Adding a schema field without documenting it now fails CI.

Correctness fixes folded in (stale text the old README carried)

• Removed caps: [js] examples — caps is a rejected legacy manifest key.
• Command table: validate-policy → validate; added logout/providers/refs/report/complete; restored update-images [--no-cache].
• docs/policies.md: dropped fictional default-js/py/js-py.yaml + "detected capabilities" model → policy lives at .openlock/policy.yaml via openlock init.
• docs/sessions.md: clean --stale actually removes exited+missing (idle-stale semantics belong to reap).
• agent reference: network_policies is a mapping (not array); binary harness is a deprecated boolean; version is required.

Tests

bun run lint / typecheck / knip clean; 744 openlock unit tests pass (incl. the new drift guard). The only local test failure is a vendored z3 JS test inside the gitignored openshell-fork/ sibling — absent in CI.

Deferred follow-ups (out of scope): README "How it works" still describes the pre-init capability-detection model; Claude Code skill packaging for the decision procedure.