docs: design doc and deployment guides for three use cases

[ceejbot]

Summary

Replaces 11 stale implementation spec files and the old deployment architecture doc with four focused documents for a technical audience evaluating zerolease for security-sensitive deployments.

New docs

design.md — The foundational document. Covers:

• The problem (why static credentials are dangerous for AI agents)
• Threat model (what we defend against, what we don't, trust boundaries)
• Core abstractions (vault, leases, transports, proxy)
• Design decisions with rationale (deny-by-default, newtypes, zeroize, decoupled storage/audit, no TLS termination, token dies with provisioner)
• What this is not (not a secrets manager, not a general proxy, not an HSM)

guide-embedded.md — For integrating zerolease into a Rust application:

• Backend selection (keychain + rusqlite)
• Initialization, policy, lease-and-access pattern
• Notes on adapting zeroclaw's built-in vault

guide-cloud-service.md — For running the vault as a shared server:

• Backend selection (KMS + PostgreSQL or AWS SM)
• Authenticator implementation
• Client usage (UDS and TCP)
• Monitoring via tracing events

guide-vm-deployment.md — The full production deployment with VMs:

• Architecture diagram
• VM image requirements (no credentials — security requirement, not convention)
• iptables network jail (default-deny outbound, proxy-only exit)
• Complete lifecycle: boot → proxy → provision → agent → revocation → destroy
• Credential manifest with all three injection mechanisms
• Proxy hardening (SSRF, DoS, port restriction, case normalization)
• Security assumptions, residual risks
• What the orchestrator provides vs what zerolease provides

Removed

• 11 implementation spec files from the pre-workspace era (design decisions are now in design.md)
• deployment-architecture.md (superseded by guide-vm-deployment.md)

Test plan

• No code changes — docs only
• CI green (workflow triggers on doc changes? If not, n/a)