Rewrite the install docs: three steps in the README and one guide for every option

[SaladDay]

Summary

Phase 4 of the new-user install work rewrites the install documentation. Someone who opens the repository sees how to install Core and Web in three steps, and there is one detailed guide for every option. The docs describe what main does now.

Pages

• README: three steps at the top: install, sign in and issue a key, add a node. Each links to its guide. Development material moves lower.
• Install guide (docs/getting-started/install.md):
  • prerequisites;
  • download: gh auth login as its own step, then gh release download and checksum verification;
  • the install command, and a table of every install.sh option;
  • choosing the sandbox backend;
  • modes and split deployments (Web-only, Core-only), with proxy layouts;
  • HTTPS reverse proxy with Caddy and nginx examples;
  • a quick-tunnel trial;
  • what is created on disk;
  • repair.
• New guides:
  • nodes.md: the sudo and no-sudo commands exactly as Web builds them, what sudo mode creates, the Docker root-equivalence warning, uninstall and --force, and a readiness-code table with the labels Web shows;
  • self-hosted.md;
  • docs/maintainers.md.
• Rewritten:
  • operations.md: the parsar commands, the Core key, backups, --convert upgrades with a pre-conversion backup, retired names and troubleshooting;
  • quickstart.md: OPENAI_BASE_URL/OPENAI_API_KEY, with the key kept out of shell history and argv;
  • configuration.md: the generated config.json table, how parsar apply works and what it restarts, and the runtime settings in Web.
• HOSTED-SANDBOX-MANAGER.md becomes the operator reference, linked from the nodes guide rather than duplicated.

Legacy paths

• Deleted services/agents-api/HOSTED-RELEASE.md, which could not supply a complete Runtime release on its own, together with its packaging step.
• RELEASE.md and CONTAINER.md are labelled advanced and linked only from the maintainers page.

Offline bundle

• A new core-distribution-manifest.py docs step, driven by a fixed list, builds the bundled docs.
• Links between bundled docs stay relative. Every other link points at the bundle's commit on GitHub, and the README banner ships inside the bundle.
• The build fails on any missing file or anchor, and on a link split across lines.
• Tests cover links whose text is code, images inside links, and anchors that follow GitHub's rules.

Terms

• Web page and action names, "Core key", and OPENAI_*.
• The harness claude_sdk is shown as "Claude Code".

Deferred on purpose

• Changing the sandbox backend is a neutral paragraph. That flow is being redesigned: maintenance is replaced by reset and online changes.
• The OpenAgentCore/oac rename is a separate series of PRs.
• The docs point out that the current published release predates these docs. Publishing a matching release is tracked separately.

Review

• Blind review: 6 P1s. Among them: the bundle's link check missed links whose text is code, the Web-only example could not work, a conversion backup path was wrong, the rename-before-convert advice was harmful, and a secret reached shell history. It also found P2s and P3s. The frontend checked UI text against Web separately.
• Fixes: 9c6fd991 and fe781f4a.
• Focused re-review of those fixes: no P0 or P1. Its P2 (the split layout broke self-hosted executors) and P3s were fixed in 41de66df, verified against a real core-console behind both proxy configs.

Verification

• Server gate: the full local server gate (install-docs-r3) passed on 41de66df. Playwright browser cases were skipped on the server (Chrome unavailable; approved skip).
• After merging main at 26224d04 (Clearer projects and Sessions: archive consequences, failure reasons, how to call #158 and Accept any Runtime image name in the Runtime reference #160 are Web-only and overlap no files here): config-reference.py --check and the manifest tests pass, and a relative-link check over all 91 Markdown files finds none broken.
• Proxy examples: Caddy passes caddy validate and nginx passes nginx -t. Both were live-tested for routing, Host handling and WebSocket upgrades.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}