docs(vrs): define host-local partition contract

[myobie]

Summary

• merge live main normally without rewriting published history
• rewrite the host-local requirements and evidence map in concise ASD-STE100 prose
• preserve one resident process per catalog and host subject
• preserve independent agent lifetime, explicit teardown authority, and local root-agent escalation
• keep catalog liveness separate from resident process and DING-sidecar liveness
• keep catalog-root and PTY-root paths stable while the catalog is live
• keep plain synced folders and direct KDL complete without required CAS or an authoring service
• preserve last-known-good local state and independent host convergence through partitions
• renumber independent fleet convergence from the old conflicting R22 to R28 because live main now owns R22 for quiet evented coordination

Semantic boundary

This PR specifies host-local supervision. It does not define transport, remote attachment, deployment, Doctor health policy, or a global catalog-liveness classifier. Optional transaction and content-addressed tools remain optional. They cannot replace plain-folder or direct-KDL operation. Root relocation remains the coordinated operation in issue #85.

Size

• previous PR prose: 200 added lines
• rewritten contract prose: 123 added lines
• exact current diff: 127 additions and 4 deletions
• the four changed lines remove an inherited native-surface false positive without changing behavior

Exact state

• live-main parent: 6d881c82cf6e2a2a72f2580efb93fd5d1822af8c
• exact draft head: 84f924db81d94a59f2e8acf9f594b9bbdcf07b80
• current main is an ancestor of the exact head
• four-file VRS diff
• draft, unmerged, and reviewer-free

Validation

Green at the exact head:

• cargo test --test invariants
• cargo test --test native_only
• cargo test --workspace --doc
• cargo doc --workspace --no-deps with five inherited warnings
• git diff --check origin/main...HEAD
• issue Define a guided migration operation for state-bearing st2 paths #85 resolves and remains open
• hosted nix flake check --print-build-logs: run 30832573123, job 91749879175