Docs pass for 0.8.0

[fstubner]

Brings the docs in line with main, which ships as 0.8.0. Nothing here touches Go code or deploys the site. Pages is run by hand after the release is published.

What changed

• One pitch. README, site hero and meta, docs description, npm package description and PRODUCT.md now lead with the sandbox. The version manager is the second sentence. PRODUCT.md records the owner's "sandbox first" decision of 2026-10-07.
• Stale or wrong claims fixed. The FAQ's host prompt answer, macOS reads and DNS, the .env gap, upstream proxy schemes, lockfile coverage, nvx setup, exit 77, the uninstall steps, the Docker Sandboxes and nvm-windows notes, and the "Verified downloads" row.
• Speed claims. The 45 s to 3 minutes and "about 75 ms" figures are gone. The FAQ and containment page give the measured figures with their conditions.
• CHANGELOG [Unreleased]. Restructured into Highlights, Upgrading from 0.7.0, Security, Added, Changed and Fixed. Every fix that affects released 0.7.0 is under Security. Entries that told the story of the removed prompt are rewritten in the present tense. The heading stays ## [Unreleased], undated.
• New pages. agents.md and blocked.md, in the sidebar and linked from the docs index.
• Install docs. States that without gh the one-liner checks only a checksum, shows the attestation command, and warns about the scoped npm name.
• Policy page. A table of every setting with its default and whether a project file needs nvx trust to loosen it.
• Microsoft NVX. One line in the README and one FAQ entry.

Not done

• The help text in internal/nvx/main.go and command_suggest.go still carries the old one-line description. commands.md mirrors nvx help, and a test pins the two together, so both change in one Go commit.
• The hero terminal and the "Checked before it runs" panel still show captures from older builds. They need recapturing with the 0.8.0 binary.
• version.go, version.ts and the v0.8.0 entry in changelog.ts are release bookkeeping and are left for the release.

Checks

• npm run build builds all pages. The known local pagefind "Access is denied" panic appears at the search step.
• npm run check:content, check:changelog and check:structured-data pass.
• The Go tests that read the docs pass: the command reference against nvx help, the exit-code table, the npx and setup claim test, and the version against the changelog heading.