v0.6.5: Renderer pipeline, docs rewrite, architecture diagrams

Lift block rendering to kernel SDK primitives (sw.renderers + sw.markdown)
so all surfaces share one markdown pipeline. Rewrite docs for external
audience — remove all fork history references. Add Mermaid architecture
diagrams, CONTRIBUTING guide, and extension tutorial.

- sw.renderers SDK module: kernel-level renderer registry
- sw.markdown SDK module: unified marked v16 + DOMPurify pipeline
- Browser extension script loader for renderer injection
- Notes + Docs surfaces migrated to sw.markdown.renderSync()
- 4 renderer extensions rewritten to IIFE + sw.renderers.register()
- 6 Mermaid diagrams in ARCHITECTURE.md
- CONTRIBUTING.md + TUTORIAL-FIRST-EXTENSION.md
- DESIGN-WORKFLOWS.md replaces fork-era design doc
- Surface alias routes removed from main.go
- ICD/SDK runners migrated to /admin/packages/ endpoints
- 13 new renderer tests
- Docs, CHANGELOG, ROADMAP cleaned of fork references

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/packages.go

@@ -55,7 +55,6 @@ func (h *PackageHandler) SetRunner(r *sandbox.Runner) {
 
 // ListPackages returns all registered packages.
 // GET /api/v1/admin/packages
-// GET /api/v1/admin/surfaces (alias)
 func (h *PackageHandler) ListPackages(c *gin.Context) {
 	typeFilter := c.Query("type")
 
@@ -78,7 +77,6 @@ func (h *PackageHandler) ListPackages(c *gin.Context) {
 
 // GetPackage returns a single package by ID.
 // GET /api/v1/admin/packages/:id
-// GET /api/v1/admin/surfaces/:id (alias)
 func (h *PackageHandler) GetPackage(c *gin.Context) {
 	id := c.Param("id")
 	pkg, err := h.stores.Packages.Get(c.Request.Context(), id)
@@ -91,7 +89,6 @@ func (h *PackageHandler) GetPackage(c *gin.Context) {
 
 // EnablePackage enables a package.
 // PUT /api/v1/admin/packages/:id/enable
-// PUT /api/v1/admin/surfaces/:id/enable (alias)
 func (h *PackageHandler) EnablePackage(c *gin.Context) {
 	id := c.Param("id")
 
@@ -116,7 +113,6 @@ func (h *PackageHandler) EnablePackage(c *gin.Context) {
 
 // DisablePackage disables a package. Admin cannot be disabled.
 // PUT /api/v1/admin/packages/:id/disable
-// PUT /api/v1/admin/surfaces/:id/disable (alias)
 func (h *PackageHandler) DisablePackage(c *gin.Context) {
 	id := c.Param("id")
 
@@ -134,7 +130,6 @@ func (h *PackageHandler) DisablePackage(c *gin.Context) {
 
 // DeletePackage uninstalls a package. Core packages cannot be deleted.
 // DELETE /api/v1/admin/packages/:id
-// DELETE /api/v1/admin/surfaces/:id (alias)
 func (h *PackageHandler) DeletePackage(c *gin.Context) {
 	id := c.Param("id")
 
@@ -182,7 +177,6 @@ func (h *PackageHandler) DeletePackage(c *gin.Context) {
 
 // InstallPackage uploads and installs a .pkg/.surface archive.
 // POST /api/v1/admin/packages/install
-// POST /api/v1/admin/surfaces/install (alias)
 //
 // Also supports pre-downloaded files via gin context:
 //   c.Set("_registry_file", "/path/to/file.pkg")   — skip form upload