docs: limit maintainer guide to build and release; merge self-hosted guides

CONTRIBUTING.md

@@ -388,7 +388,7 @@ settings remain unchanged. No old label is accepted as a fallback.
 
 Historical Runtime and project-version upgrades are not supported. Do not ship
 retired installer conversion implementations; preserve rejection guards under the
-[installer lifecycle contract](docs/maintainers.md#distribution-and-installer-rules). Preserve
+[installer lifecycle contract](deploy/install/README.md#versions-and-the-lock). Preserve
 older installations, Runtime files, provider resources and Session history;
 install the current release separately. Startup never verifies and rebinds historical
 allocations or accepts node deployments without a valid specification. Keep the

apps/docs/content/docs/admin-api.mdx

@@ -59,7 +59,7 @@ failures retain the sign-in error shape above.
 Poll the same-origin GET while preparing. Applying the change restarts Web and
 ends its sign-in sessions; provide a link to the submitted HTTPS origin for a
 fresh login. A dropped request or cross-origin browser probe does not prove
-success. The [installer contract](https://github.com/MiniMax-AI/parsar-core/blob/f6d258735fc601c521dd990e6f9e1ed261f4ef2d/docs/maintainers.md#managed-https-ownership) owns
+success. The [installer contract](https://github.com/MiniMax-AI/parsar-core/blob/f6d258735fc601c521dd990e6f9e1ed261f4ef2d/deploy/install/README.md#managed-https) owns
 certificate verification, locking, retry and rollback.
 
 ## Console to Core

apps/docs/content/docs/environments-and-files.mdx

@@ -526,9 +526,13 @@ tools, files or network access. Outer Environments own managed isolation, and
 unsupported network restrictions reject instead of silently running unrestricted.
 
 Native installation and validation limits are in the
-[native guide](/self-hosted-native). Historical acceptance evidence
+[self-hosted guide](/self-hosted-execution#platforms). Historical acceptance evidence
 stays limited to its recorded binaries and inputs.
 
+On Windows, npm package installation and stdio MCP commands named `npm` or `npx`
+(including their `.cmd` shims) run through the resolved npm installation's
+JavaScript entrypoint with Node, without an extra shell.
+
 ### Environment initialization and compute wake
 
 Environment initialization has pending, running, complete and failed states.

apps/docs/content/docs/execution-model.mdx

@@ -49,7 +49,7 @@ exception: the console authenticates the same browser session and origin, then
 calls the installer's private Unix socket with its server-held Core key. This is
 not a Core `/core/v1` route and does not use `AdminClient`. It can configure only
 the managed domain; it cannot submit shell commands or arbitrary process settings.
-The [installer rules](https://github.com/MiniMax-AI/parsar-core/blob/f6d258735fc601c521dd990e6f9e1ed261f4ef2d/docs/maintainers.md#managed-https-ownership) own application,
+The [installer rules](https://github.com/MiniMax-AI/parsar-core/blob/f6d258735fc601c521dd990e6f9e1ed261f4ef2d/deploy/install/README.md#managed-https) own application,
 certificates and recovery. Before a domain is configured, the console accepts
 same-origin HTTP requests at literal IP addresses; after apply, only the configured
 HTTPS origin is accepted.

apps/docs/content/docs/harness-onboarding.mdx

@@ -46,7 +46,7 @@ same contract. Operating-system support belongs in the implementation and its
 qualification. The native daemon supports Linux, macOS and Windows; each adapter
 declares its qualified platform scope. Managed Providers remain Linux-only.
 A platform-neutral interface alone does not qualify a harness on another platform.
-See [native Runtime validation](/self-hosted-native) for the current
+See [self-hosted platforms](/self-hosted-execution#platforms) for the current
 acceptance limits. Runtime connection, installed capability snapshot, Session Executor and Turn
 each have their own lifetime; see
 [Executor and Turn lifetimes](/runtime-protocol#executor-and-turn-lifetimes).

apps/docs/content/docs/index.mdx

@@ -20,7 +20,6 @@ API. Pick the path that matches your role. New here? Read the
 | [Configuration](/configure) | `config.json`, default models, sandbox deployment |
 | [Nodes](/hosted-providers) | Adding, checking and removing managed nodes |
 | [Self-hosted execution](/self-hosted-execution) | Connecting your own machine to a Session |
-| [Native Runtime](/self-hosted-native) | Platforms, installing and operating `oac-daemon` |
 | [Operations](/troubleshooting) | Services, backups, keys, repair and troubleshooting |
 | [Web console](/console) | What the console shows and manages |
 

apps/docs/content/docs/meta.json

@@ -20,7 +20,6 @@
     "environments-and-files",
     "hosted-providers",
     "self-hosted-execution",
-    "self-hosted-native",
     "---Administration---",
     "console",
     "admin-api",

apps/docs/content/docs/public-api.mdx

@@ -58,7 +58,7 @@ core() {  # core METHOD PATH [JSON body]
 | Archive a Project (revokes all keys) | `core POST /projects/$PROJECT_ID/archive` |
 | See harnesses and their default models | `core GET /harnesses` |
 | Set Codex's default model | `core PUT /harnesses/codex/model-configuration '{"model": "your-model-id", "model_provider": {"protocol": "responses", "base_url": "https://provider.example/v1", "api_key": "sk-..."}}'` |
-| Issue an executor credential | See [self-hosted execution](/self-hosted-execution#operator-credential-management) |
+| Issue an executor credential | See [executor credentials](https://github.com/MiniMax-AI/parsar-core/blob/f6d258735fc601c521dd990e6f9e1ed261f4ef2d/contracts/agents-api/environment-executor-credentials.md#core-key-routes) |
 | Installation facts, including the API base URL | `core GET /installation` |
 
 Errors use the [Core error envelope](https://github.com/MiniMax-AI/parsar-core/blob/f6d258735fc601c521dd990e6f9e1ed261f4ef2d/contracts/agents-api/core-errors.md).
@@ -128,9 +128,10 @@ Creating or reading a `self_hosted` Session returns short-lived install commands
 `GET /core/v1/projects/{project_id}/environments/{environment_id}/installation`.
 Machine installers use `POST /api/v1/agent-daemon/installation` and its `/claim`
 subroute with the installation Bearer authorization. Qualified artifacts under
-`/api/v1/agent-daemon/install/{version}/` are public, immutable release content. See
-the [native Runtime guide](/self-hosted-native) for expiry, retry, credential
-ownership and platform rules.
+`/api/v1/agent-daemon/install/{version}/` are public, immutable release content. The
+[installation grant](https://github.com/MiniMax-AI/parsar-core/blob/f6d258735fc601c521dd990e6f9e1ed261f4ef2d/contracts/agents-api/environment-executor-credentials.md#installation-grant)
+owns expiry, retry and credential ownership; the
+[self-hosted guide](/self-hosted-execution#platforms) lists platforms.
 
 The console-local `GET`/`POST /console/installation/domain` surface uses the signed-in
 browser session and same-origin checks. It delegates only domain setup to the