docs: document JSON-first auth profile preflight

[andrei-hasna]

Summary

• replace the stale documentation scope from PR docs: document Codewith auth profile preflight #25 on current main
• document JSON-first exact profile matching and authoritative root data/profiles inventories
• document usable:false rejection, legacy entries, currentProfile exclusion, compatibility-only table fallback, NUL rejection, and local/remote fail-closed parity

Scope

Documentation only: CHANGELOG.md, README.md, and docs/USAGE.md. No runtime, package, or workflow changes.

Validation

• git diff --check
• bun install --frozen-lockfile
• bun run build
• bun run typecheck
• bun test src/lib/executor.test.ts: 57 pass, 0 fail
• bun run test:boundary
• staged and exact-commit gitleaks scans: no leaks

Parent queue item: LOO3-00031. This PR is the bounded replacement for #25; the PR-zero coordinator owns final disposition.