docs: make controlled-alpha onboarding executable

[wms2537]

Summary

• add a Docker-only public-image quickstart with a safe loopback demo profile
• add executable first-run and approval/recovery clients
• add operational tutorials for first Run, worker-restart recovery, and the Kertas public contract
• make internal Markdown links and the documented Compose flow part of the controlled-alpha CI gate
• update the README, Usage Guide, and release runbook for the now-public alpha image

Why

The controlled-alpha image was publicly pullable, but a newcomer still had to invent PostgreSQL wiring, runtime configuration, the first API call, and the recovery exercise. Existing scenario articles demonstrate use cases but do not provide an executable onboarding path.

Impact

A user with Docker can now complete a deterministic durable Run without local Node.js, BytePlus credentials, or model spend. The same Compose path is exercised against each release candidate in CI. Kertas integration remains limited to the versioned public API and event protocol.

Verification

• TDD onboarding contract: 8/8
• internal documentation links: 23 Markdown files
• live public-image quickstart: first durable Run PASS
• live approval recovery across worker restart: PASS
• TypeScript typecheck: PASS
• full suite: 65 files / 483 tests
• exact-commit controlled-alpha gate: PASS
• git diff check: PASS

Fixes #61