Document organization config policy

[codeforester]

Summary

• document optional future organization-wide Base config policy
• clarify that v1 must not implicitly load /etc/base.d/config.yaml
• describe explicit opt-in behavior for managed config
• rename the Zsh baserc guard helper from .sh to .zsh
• update Zsh startup snippets to source the renamed helper
• clear the completed TODO queue

Testing

• bats cli/bash/commands/basectl/tests/setup.bats