docs: fold the workspace-root docs into the repo, with honest status

The root held four Markdown files that were not in any git repo and were being read as
current. CLAUDE_SIDECAR_ISOLATION.md is the one that prompted this: it describes, in the
present tense, an agent that dies whenever officer restarts. That was true when it was
written and has not been true for two days.

Rather than delete analysis that version control was not holding, the two substantial ones
moved into platform/docs/ with headers that say what has since happened:

- claude-sidecar-isolation.md — stages 0-2 are done and running (R1, R2, R4, R5 all
  satisfied); stages 3-5 are the only live part.
- sidecar-audit-2026-07.md — a snapshot audit, largely executed. Email, pty, music and vnc
  have been done since; claude, opencode and the cross-cutting notes are still open. The
  vault stays off-limits.

MUSIC_IMAGES_SPEC.md is deleted outright: the sidecar serves /image and /poster, so the
spec is the feature. The workspace root now holds one Markdown file, CLAUDE.md, which is
where cross-cutting operational reality belongs.

Also corrected, in the same pass:
- root CLAUDE.md listed email as "the big one, and untouched" and pty stage 4 as
  outstanding; both are done. It now names what actually remains (claude stages 3-5, the
  terminal orphan leak) and what landed.
- docs/sidecar-topology.md said "nothing built yet". Two sidecars now serve their own
  transport; what has NOT happened is the part the document is about — fixed ports, the
  shared table, .env toggles — so it says exactly that rather than implying the design is
  underway. Migration order updated: pty and email went first, not music.
- docs/navigation-audit.md is cited as authoritative but still planned work on Projects,
  a feature since deleted. A status header marks H3 void, H1/H2 done and H4 the one open
  item, so nobody follows it into a directory that no longer exists.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/sidecar-topology.md

@@ -1,8 +1,14 @@
 # Sidecar topology — the target shape
 
-**Status:** agreed design, 2026-07-30. Nothing built yet. Owner's design; this file is the record.
+**Status:** agreed design, 2026-07-30. Owner's design; this file is the record.
 
-Not to be confused with `SIDECAR_ARCHITECTURE.md` at the workspace root, which is the *audit* of the
+**Progress.** Points 5 and 6 are partly real already, ahead of the rest: **pty** and **email** now serve
+their own HTTP/WS listeners and the platform is a byte relay and a proxy onto them, with no command
+vocabulary left between them. Every HTTP sidecar shares one `createSidecarProxy` factory. What has NOT
+happened is the part this document is actually about — fixed ports, the platform reading a table instead
+of being told at runtime, and `.env` feature toggles. Ports are still ephemeral and still announced.
+
+Not to be confused with `sidecar-audit-2026-07.md`, which is the *audit* of the
 current state (what's misplaced, and where). This is where it's going.
 
 ## The premise that makes it simple
@@ -35,22 +41,25 @@ Until that lands, things stay exposed as they are now. The security model is del
 The point of the exercise, and the reason it's worth doing:
 
 - `sidecar/connect.ts` — the dial-out-and-register loop, plus its per-sidecar reconnect backoff copies
-- every port announcement: `music:server`, `slskd:server`, `vault:server`, `opencode:server`, `vnc:started`
+- every port announcement: `music:server`, `slskd:server`, `vault:server`, `opencode:server`,
+  `pty:server`, `email:server`, `wallet:server`, `headscale:server`, … and `vnc:started`
 - most of `sidecar-registry.ts` — discovery, the pending-command map, capability lookup
 - officer's proxying for anything that isn't auth or layout state
 
-## Migration: music first, end to end
+## Migration order
 
-One sidecar all the way through before touching the other nine. Music because it's the highest-traffic,
-the least dangerous if it breaks, it already listens on a port, and it already has an app of its own.
+The original plan was music-first. In practice **pty** and **email** went first, because both had platform
+code that had to move regardless, and both are now the worked examples of the end state: the sidecar owns
+its transport, the platform authenticates and forwards.
 
-Keep officer's existing proxy in place as a fallback during the change, so a bad step is a revert rather
-than an outage. Vault last — it's off-limits by standing instruction and is the least urgent anyway.
+What remains is the topology work itself — fixed ports, the shared table, `.env` toggles — which touches
+every sidecar at once rather than one at a time. Vault last: off-limits by standing instruction, and the
+least urgent anyway.
 
 ## Open questions
 
 - **Ecosystem file, or a shared table?** The platform parsing `ecosystem.config.cjs` couples the app to
-  PM2 being the thing that started it, which matters for `DOCKERIZATION_PLAN.md` and for `bun dev`.
+  PM2 being the thing that started it, which matters for containerising this later and for `bun dev`.
   The alternative is one plain TypeScript table (name, script, port, capability, enabled) that
   `ecosystem.config.cjs` generates its `apps:` array from and the platform imports directly — same single
   source of truth, no supervisor coupling. **Recommended, not yet decided.**