docs(architecture): update 0.1.0 runtime overview

[drew]

Summary

Update the published architecture overview to match the OpenShell 0.1.0 runtime model. The page now documents the external supervisor, capability-free workload boundary, high-availability gateway relays, and negotiated extension contracts.

Related Issue

No issue required: this docs-only change corrects the architecture page to reflect behavior already implemented for 0.1.0.

Changes

• Redraw the architecture diagram around the gateway, supervisor, sandbox runtime, and outer network fence.
• Document the current trust, isolation, credential, and network boundaries.
• Add runtime placement details for Docker, Podman, Kubernetes, VM, and Windows MXC.
• Describe multi-replica gateway session ownership and extension protocol negotiation.
• Add links to detailed runtime, policy, Kubernetes, and extension documentation.

Testing

• mise run docs passes.
• mise run pre-commit passes.
• Unit tests added/updated (not applicable to a documentation-only change).
• E2E tests added/updated (not applicable to a documentation-only change).

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Architecture docs updated (if applicable).

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3541.docs.buildwithfern.com/openshell