docs: bring the guides up to the shipped model The generated codebase maps were regenerated today; these are the hand-written guides that had drifted behind them. extending-stacks: drop the "Status: proposed" header — extends: shipped (schema.py _locate_parent_stack / _resolve_stack_extends, 8 tests in test_stack_extends.py). Three specced rules had no implementation and are removed rather than left as false promises: the recipe-variety extend ban, the repo-cannot-extend-overlay rule, and the credential-forwarding provenance notice. The last two are security rules and are tracked as harnessed-s7v. Also corrected: ssh_keys IS union-inherited (_STACK_UNION_FIELDS) with enforcement at the mount point (_trusted_ssh_keys drops non-overlay keys); state: is a full block replace, not a per-key merge. stacks: the harness is not a stack property. Removed `harness: claude` from the schema block, both worked examples, and the `harnessed new` output — the singular field is rejected by the validator, and `harnessed new` has no --harness flag at all (it rejects a stack NAMED after a harness instead). Added instructions: and extends:. Repointed three dead examples at gsd-core_repowise. recipe-authoring: document install:, env:, and setup.script — the install mechanism was previously absent from the guide entirely. container-filesystem: per-stack volumes replaced the image-layer model (harnessed-8px.21); the profile is composed into the volume, not mounted over it as seven per-subdir ro binds. secrets + codebase maps: CLAUDE_CODE_OAUTH_TOKEN is the primary claude auth path, and no credential file is mounted when one is configured. The .credentials.json path is a legacy fallback that seeds a per-instance rw COPY — so "credentials are never copied" was wrong in both the guide and the generated maps. harnessed-update: new guide. The command shipped with no documentation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>