docs(site): migrate doc site to VitePress with guides and bespoke landing

[enixCode]

Summary

• Switch the doc site to VitePress while preserving the bespoke landing aesthetic (Fraunces / IBM Plex / dark grid + noise GPU layer). The HTML+CSS lives unchanged in docs/public/index.html and is served verbatim at /. VitePress takes over /guides/* and /api/* with its standard chrome (sidebar, dark mode, local search, edit-this-page links, last-updated stamps).
• Add 5 user-facing guides under docs/guides/: quickstart (recap of the README quick start), extract (folder-vs-file semantics, traversal rules, 1 GiB cap, common patterns), detached (run + attach + state files + cross-host resume + reaping + gotchas), security (threat model, defaults, what is and is not covered, hardening recipes), gvisor-kata (when to use a stronger runtime, install steps for runsc on Linux/WSL2, Kata caveat).
• Switch TypeDoc to markdown emission via typedoc-plugin-markdown@4.11.0. The API reference is regenerated under docs/api/*.md and consumed by VitePress as regular markdown routes. entryFileName: "index" so /api/ resolves cleanly.
• Add .github/workflows/docs.yml that rebuilds and deploys to GitHub Pages on every push to main touching docs/, src/, or relevant config files. Uses actions/upload-pages-artifact + actions/deploy-pages with concurrency-guarded deploys.
• Restructure npm scripts: docs:typedoc regenerates the markdown API ref (fast, ~1s), docs:build runs vitepress build (~8s), docs chains both, docs:dev serves locally with live reload. The pre-commit hook now calls docs:typedoc only (no dist artefact churn) so the API reference still auto-syncs when src/ is staged.
• Add devDeps: vitepress@1.6.4, typedoc-plugin-markdown@4.11.0. No runtime deps changed (still tar + dockerode).

One-time manual step required

After merge, in repo Settings -> Pages, flip the source from "Branch / docs folder" to "GitHub Actions". The workflow runs but cannot publish without that. I cannot toggle this via API.

Test plan

• npm run docs:build completes locally in 7.6s, no dead links, no warnings beyond TypeDoc's existing one about the private LightRunnerErrorOptions interface
• docs/.vitepress/dist/index.html serves the bespoke landing verbatim (CSS + noise + grid intact)
• docs/.vitepress/dist/guides/* pages render with VitePress chrome (sidebar, search, dark mode toggle)
• docs/.vitepress/dist/api/index.html serves the TypeDoc-generated markdown rendered through VitePress
• Pre-commit hook regenerates docs/api/ only (no full VitePress build) when src/ is staged
• docs/.vitepress/cache/ and docs/.vitepress/dist/ gitignored
• After merge + Pages source flip: verify https://enixcode.github.io/light-runner/ updates within ~3 min

Notes

• The bespoke landing already had updated v0.10 metadata (license MIT, version, deps, tests) from the previous PR. It now lives under docs/public/ to integrate with VitePress' static asset pipeline. The README image link was bumped to docs/public/banner.webp.
• Rollback is clean: git revert <squash-sha>, npm uninstall -D vitepress typedoc-plugin-markdown, restore the old typedoc.json and the workflow.
• Auto-sync story for future contributors: any push to main that touches src/ will trigger both the pre-commit hook (auto-stages docs/api markdown) and the docs.yml workflow on push (rebuilds + redeploys). No manual intervention needed.

build with cc