DOCS-010: refresh or demote dotfiles-architecture-map; add current-era Mermaid diagrams

[mlorentedev]

Source: docs audit 2026-07-07 (docs/audits/docs-audit-2026-07-07.md) — finding D7 (CONFIRMED), diagram backlog §5, open question Q2.

docs/adr/dotfiles-architecture-map.md (2026-05-19 snapshot) is still routed to as first-read orientation, but both diagrams and 3 of its 4 tables describe the pre-ADR-028 / pre-strangler world: SSOT list includes sensitive/env-mapping.conf; the runtime diagram shows secrets exported to the shell env (reversed by ADR-028); Layers/"Where does X live" cite ≥8 retired scripts (load-secrets, healthcheck.sh, doctor.sh, claude-session-start.*, init-project.*, github-secrets-manager.sh, …); ai/gemini row; stale counts.

Decide (Q2): regenerate as a new dated snapshot, or demote (status: superseded-snapshot) and let docs/architecture.md own orientation. Either way, land the §5 diagrams — the audit report contains ready Mermaid drafts for:

1. Secrets two-tier architecture + command flows → guide-secrets-governance.md (referenced from ADR-028).
2. Corrected runtime data-flow (no ambient secrets; dotf mem session hooks; dotf update timer) → map or docs/architecture.md.
3. dotf update skip-ladder lifecycle → guide-self-deploy-timer.md.
   Backlog also names: ADR-025 cascade, ADR-030 read/write asymmetry, bitácora status lifecycle.