docs: refresh README, user guide, architecture, and templates for v1.6

[giftedloser]

Summary

Documentation and repo hygiene pass to align user-facing docs with the
v1.6 Runway app (first-run setup, sync status pill, Tags view + drawer,
Provisioning Builder, Build Payload availability states, EntityPicker
for Change Primary User, single-device destructive actions, deep-linked
tabbed device detail). No product features added; no package version
bump; no main push.

Docs changed

• README.md — replaced stale "1.0 Readiness" with a tenant testing
  warning; expanded "What it does" with first-run setup, sync pill,
  Tags, Provisioning Builder, Build Payload, EntityPicker, centralised
  portal links, custom-rule preview; added "What it intentionally does
  not do".
• docs/user-guide.md — end-to-end rewrite. New sections: first-run
  setup, sync status pill, Tags view + drawer, Provisioning Builder
  workflow, Build Payload panel + availability states, EntityPicker
  primary-user search, tabbed device detail (Identity/Targeting/
  Enrollment/Drift/Operate/History) with ?tab= deep-links, tenant
  testing workflow.
• docs/architecture.md — added app-only vs delegated split, first-run
  completion criteria, sync status source of truth, tag_config cleanup
  notes, raw_graph_assignment, Build Payload data flow, and a non-goals
  section.
• docs/live-testing-checklist.md — first-run setup, sync pill, Tags,
  Provisioning Builder + Build Payload, EntityPicker, and 1.5 → 1.6
  rollback notes.
• docs/security-report.md — destructive confirmations always
  enforced, idempotency keys, EntityPicker, snapshot retention.
• docs/runway-overview.md — removed fabricated test count and bundle
  size claims.
• CONTRIBUTING.md — added branch/PR expectations and CHANGELOG
  discipline section.
• .github/pull_request_template.md — added Risks section.
• .github/ISSUE_TEMPLATE/bug_report.md — added Setup state and
  expanded affected-surface options for Setup, Sync pill, Tags,
  Provisioning Builder, Build Payload.
• CHANGELOG.md — added [Unreleased] Documentation entry.

Stale docs removed

• "Confirm destructive actions toggle" (toggle was removed in v1.6;
  destructive confirmations are always enforced).
• "enter user object ID" / "raw GUID" instructions on Change Primary
  User (replaced by EntityPicker search by display name, UPN, or mail).
• Settings-side individual tag mapping editing (now lives in the Tags
  side drawer; Settings only handles JSON import/export).
• Section-numbered references like "Section 9 Tag Mapping" (section
  numbers shift; user guide now indexes by section title).
• Fabricated "256 / 256 tests passing" and bundle-size benchmarks in
  docs/runway-overview.md.

Validation

• npm run lint ✅ (no errors)
• npm run typecheck ✅
• npm run test ✅ 319 unit + api tests pass (31 files)
• npm run test:e2e ✅ 30 e2e tests pass (4 files)
• npm run build ✅ client + server bundles built clean
• package.json version unchanged (still 1.6.0)
• Stale-phrase grep (Section 9, Confirm destructive,
  user object ID, raw GUID, never-disable-confirmations) — only
  hits in CHANGELOG entries (describing the removals) and in new docs
  describing that raw GUIDs are no longer required.

Screenshots

No screenshots updated — current docs do not embed UI screenshots and
the repo does not have an automated screenshot tooling convention. If a
screenshot pass is desired for the user guide, recommend doing it as a
follow-up against a frozen build so screenshots stay in sync with
release artifacts.

Risks

• Pure documentation / template / changelog changes — no runtime,
  schema, or behaviour impact.
• Linked anchors and relative paths inside docs were preserved or
  updated; reviewers should still spot-check docs/user-guide.md
  navigation links if they spot an anchor renamed.

Remaining decisions

• Screenshot generation tooling is not in scope for this PR.
• A future docs sweep can drop docs/runway-overview.md if its content
  is fully covered by README + user guide.