v0.6.5: Renderer pipeline, docs rewrite, architecture diagrams

Lift block rendering to kernel SDK primitives (sw.renderers + sw.markdown)
so all surfaces share one markdown pipeline. Rewrite docs for external
audience — remove all fork history references. Add Mermaid architecture
diagrams, CONTRIBUTING guide, and extension tutorial.

- sw.renderers SDK module: kernel-level renderer registry
- sw.markdown SDK module: unified marked v16 + DOMPurify pipeline
- Browser extension script loader for renderer injection
- Notes + Docs surfaces migrated to sw.markdown.renderSync()
- 4 renderer extensions rewritten to IIFE + sw.renderers.register()
- 6 Mermaid diagrams in ARCHITECTURE.md
- CONTRIBUTING.md + TUTORIAL-FIRST-EXTENSION.md
- DESIGN-WORKFLOWS.md replaces fork-era design doc
- Surface alias routes removed from main.go
- ICD/SDK runners migrated to /admin/packages/ endpoints
- 13 new renderer tests
- Docs, CHANGELOG, ROADMAP cleaned of fork references

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/icd-test-runner/js/tier-security.js

@@ -543,7 +543,7 @@
     await T.test('security', 'input-validation', '[P0] path traversal in surface archive', async function () {
       var blob = new Blob([JSON.stringify({ id: '../../../etc/evil', title: 'Path Traversal Test' })], { type: 'application/json' });
       try {
-        var d = await T.apiUpload('/admin/surfaces/install', blob, 'evil.surface');
+        var d = await T.apiUpload('/admin/packages/install', blob, 'evil.surface');
         T.assert(d._status === 400 || d._status === 409,
           'path traversal surface accepted! got ' + d._status);
       } catch (e) {
@@ -644,8 +644,8 @@
         assertDenied(d._status, 'CRITICAL: team admin can delete users');
       });
 
-      await T.test('security', 'escalation', '[P0] teamAdmin → POST /admin/surfaces/install', async function () {
-        var d = await T.authFetch(teamAdmin.token, 'POST', '/admin/surfaces/install', {});
+      await T.test('security', 'escalation', '[P0] teamAdmin → POST /admin/packages/install', async function () {
+        var d = await T.authFetch(teamAdmin.token, 'POST', '/admin/packages/install', {});
         if (d._status === 400) return; // bad upload format, not a security issue
         assertDenied(d._status, 'team admin can install surfaces');
       });