docs: embedding contract, stability statement, and IdP callout for the hosted substrate

[davidfarah2003]

What

W2 of the hosted-substrate-readiness plan (pin down the embedding contract) plus W3's two non-seam verification bullets. Documents how a separate closed repo consumes the published @cotal-ai/* packages as a hosted substrate. Docs-only.

• docs/embedding.md (new): the library-export audit, the three-daemon integration guide (auth-service, delivery, supervise), hazardous-primitives guardrails, the not-yet-hosted-composable gaps, and the durable-state boundary.
• docs/stability.md (new): what wire v0.3 and packages 0.12.x guarantee, the pre-1.0 npm semver caveat, and the projected v0.4 break-family list.
• docs/identity-and-auth.md: a new "IdP callout contract" section and the Better Auth isolation.
• Reconciles the now-inaccurate "signing key confined to the auth service" claim across identity-and-auth, security, and roadmap, and adds a broker-enforced-guarantee caveat to the security threat model.

Audit conclusion (three tiers)

1. Export availability: GREEN. Every symbol a closed composition root needs (daemon runners, the full mint/profile matrix, provisioning primitives, auth building blocks, seams, endpoint) is a real published export. Proved by runtime import of the built dist plus TS-declaration emission. Packages are 0.12.0 (not the plan's stale 0.11.x).
2. Supported hosted composition (one-space reference shape): auth-service (full SecretStore read seam), delivery (Plane-3 durable backstop), supervise via Manager as a trusted per-tenant account-signer.
3. Not hosted-composable from the public contract yet (documented gaps, each tied to in-flight work, none built here): delivery broker-sourced membership + live eviction (private on-disk file protocol), manager secret threading, many-spaces-per-broker provisioning, and a non-Better-Auth production IdP.

W3 verified: Better Auth is a dev-only dependency (dev-idp + smokes; runtime coupling is idp.ts + the auth-provider extension, IdP-agnostic via config); hosting-critical durable state is enumerated, coordination state is JetStream-resident.

Review

Mesh panel (engineer / security / critic, opencode gpt-5.6-sol high): 3/3 LGTM after a plan review and two artifact-review fold rounds. Independent freelance cold read folded (it caught the IdP auto-registration collision, the unset protocolVersion, and a remintDaemonCreds throw path, among others).

Decision needed

The stability statement leaves open Decision 4: at what package version the embedding surface is "stable to build a paid product on", and whether to publish a pre-1.0 semver / support policy. Raising separately.

Flagged follow-ups (out of this PR)

• The signer-leak severity is still minimized in deploy/README.md and the public stripSpaceAuth TSDoc (packages/core/src/provision.ts); left because provision.ts is being churned by the secret-store seam work. Fold into the next secret-seam / deploy-doc refresh.
• docs/deploy.md's container-isolation intro ("no host file access") is a pre-existing self-contradiction for the deploy-doc owner.