v0.6.5: Renderer pipeline, docs rewrite, architecture diagrams

Lift block rendering to kernel SDK primitives (sw.renderers + sw.markdown)
so all surfaces share one markdown pipeline. Rewrite docs for external
audience — remove all fork history references. Add Mermaid architecture
diagrams, CONTRIBUTING guide, and extension tutorial.

- sw.renderers SDK module: kernel-level renderer registry
- sw.markdown SDK module: unified marked v16 + DOMPurify pipeline
- Browser extension script loader for renderer injection
- Notes + Docs surfaces migrated to sw.markdown.renderSync()
- 4 renderer extensions rewritten to IIFE + sw.renderers.register()
- 6 Mermaid diagrams in ARCHITECTURE.md
- CONTRIBUTING.md + TUTORIAL-FIRST-EXTENSION.md
- DESIGN-WORKFLOWS.md replaces fork-era design doc
- Surface alias routes removed from main.go
- ICD/SDK runners migrated to /admin/packages/ endpoints
- 13 new renderer tests
- Docs, CHANGELOG, ROADMAP cleaned of fork references

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/icd-test-runner/js/tier-authz.js

@@ -28,7 +28,7 @@
     var adminGets = [
       '/admin/stats', '/admin/users', '/admin/settings',
       '/admin/configs', '/admin/models', '/admin/personas',
-      '/admin/teams', '/admin/groups', '/admin/surfaces',
+      '/admin/teams', '/admin/groups', '/admin/packages',
       '/admin/providers/health', '/admin/routing/policies',
       '/admin/permissions', '/admin/roles', '/admin/vault/status',
       '/admin/storage/status', '/admin/audit', '/admin/pricing',
@@ -72,8 +72,8 @@
         'expected 403/401, got ' + d._status);
     });
 
-    await T.test('authz', 'admin-deny', 'user → POST /admin/surfaces/install (expect 403)', async function () {
-      var d = await T.authFetch(testUser.token, 'POST', '/admin/surfaces/install', {});
+    await T.test('authz', 'admin-deny', 'user → POST /admin/packages/install (expect 403)', async function () {
+      var d = await T.authFetch(testUser.token, 'POST', '/admin/packages/install', {});
       T.assert(d._status === 403 || d._status === 401 || d._status === 400,
         'expected 403/401/400, got ' + d._status);
     });