docs: restructure into topic subdirectories, collapse duplicated index

Per mara's go-ahead on hyperhive#3902 ("getting started is good, but
terminal rendering does not go in there i think"):

Moved 21 top-level docs/*.md files into 7 new topic subdirectories
(existing web-ui/, turn-loop/, swarm/, tools/, crates/ untouched):
  getting-started/  setup.md
  agent-lifecycle/  agent-hierarchy.md, approvals.md, persistence.md
  trust-boundary/   boundary.md, security.md
  integrations/     forge.md, matrix.md, github.md, knowledge.md
  networking/       gateway.md, network.md, snapshot-store.md
  scheduler/        jobq.md, coordinator.md, ci.md, observability.md
  process/          conventions.md, gotchas.md, pr-review-gate.md
  web-ui/           terminal-rendering.md (moved into the EXISTING dir,
                    per mara's correction to the original getting-started
                    guess -- it's UI implementation detail, not onboarding)

The physical layout now matches docs/README.md's own topical headers,
which already amounted to this taxonomy -- see the scoping comment on
the issue for the two findings that motivated this (a genuine
duplication between CLAUDE.md's old "Reading paths" list and
docs/README.md's grouped one, since drifted out of sync with each
other; and the flat layout not matching the grouping we already had).

Fixed every cross-reference this moved across the whole repo (~120
files: docs/ internal links at every depth, Rust doc comments, nix
module option docs, crate READMEs) -- verified two ways: a grep sweep
confirming zero remaining references to any old path, and a script
that resolves every markdown link in docs/**/*.md + CLAUDE.md +
README.md against the filesystem and reports anything that doesn't
exist (zero broken links).

Collapsed CLAUDE.md's "Reading paths" section (the duplicate) down to
a pointer at docs/README.md, now the single index. Rewrote
docs/README.md itself to use the new subdirectory paths and added the
one doc it was missing that CLAUDE.md's old copy had (pr-review-gate.md).

Classified all 22 docs/*.md files first via a haiku subagent (mara's
suggestion) on two axes -- proposed grouping and operator-vs-
implementation focus -- before finalizing the taxonomy; spot-checked
the report and found internal inconsistencies (its classification
table disagreed with its own summary section for a few files), so this
taxonomy is my original proposal + the one correction mara gave
directly, not a blind application of the subagent's table. The
operator-focus data it gathered is still useful for a follow-up
content pass (docs skewing 'mixed' rather than pure operator-facing),
not addressed in this PR -- structure only.

nix fmt clean, both pre-push lints clean.

hive-agent/src/harness_state.rs

@@ -69,7 +69,7 @@ pub(crate) fn persist_effort(level: &str) -> std::io::Result<()> {
 // (`hyperhive-rate-limited`, `hyperhive-needs-login`) that grew organically
 // and had no shared schema. A single JSON file is self-documenting, atomic
 // to write, and cheaper for hive-c0re to read on each sweep (one fopen vs
-// two stat calls). See `docs/persistence.md::Harness state files`.
+// two stat calls). See `docs/agent-lifecycle/persistence.md::Harness state files`.
 //
 // Legacy sentinel files written by older harness builds are still honoured
 // by `read_harness_state` so in-place upgrades don't lose state (the new

hive-agent/src/identity.rs

@@ -1,7 +1,7 @@
 //! Agent identity helpers — short label + hive-qualified long name +
 //! human display names for the hive and swarm. Full env var surface +
 //! domain-vs-name distinction documented in
-//! `docs/conventions.md::Hive identity (label + domain + display names)`.
+//! `docs/process/conventions.md::Hive identity (label + domain + display names)`.
 
 use std::env;
 

hive-agent/src/mcp_config.rs

@@ -37,7 +37,7 @@ pub const ALLOWED_BUILTIN_TOOLS: &[&str] = &["Edit", "Glob", "Grep", "Read", "Sk
 /// Env var written by the meta renderer with a comma-separated list of
 /// `hive_sh4re::permissions::ToolGroup` `snake_case` names (e.g. `"messaging,inbox,meta"`).
 /// When present, the harness expands the groups into per-tool allow entries
-/// instead of using the hardcoded flavor default. See `docs/conventions.md::Tool groups`.
+/// instead of using the hardcoded flavor default. See `docs/process/conventions.md::Tool groups`.
 const TOOL_GROUPS_ENV: &str = "HIVE_TOOL_GROUPS";
 
 /// `HIVE_CAPABILITIES` env var injected by `meta::render_flake` when the
@@ -164,7 +164,7 @@ mod extra_server_gate_tests {
 /// MCP tools claude is allowed to call without prompting, derived from
 /// the supplied tool groups. Adding a new `#[tool]` fn to a server impl
 /// requires updating the matching `ToolGroup::tools()` slice in hive-sh4re
-/// (single source of truth). See `docs/conventions.md::Tool groups`.
+/// (single source of truth). See `docs/process/conventions.md::Tool groups`.
 #[must_use]
 pub fn allowed_mcp_tools(groups: &[hive_sh4re::permissions::ToolGroup]) -> Vec<String> {
     // Collect all tool names, deduplicating while preserving order.

hive-agent/src/otel_turn_metrics.rs

@@ -1,6 +1,6 @@
 //! Per-turn OTEL metric export for the fields Claude Code's own built-in
 //! OTEL integration cannot know about. Claude's own export already covers
-//! token usage, cost, and tool-call counts (see `docs/observability.md`) —
+//! token usage, cost, and tool-call counts (see `docs/scheduler/observability.md`) —
 //! duplicating those here under different metric names would just give a
 //! collector two disagreeing series for the same number. This module emits
 //! only the harness-only concepts: wall-clock turn duration as *this harness*
@@ -149,7 +149,7 @@ fn build_provider(interval: Duration) -> anyhow::Result<SdkMeterProvider> {
     // OTLP client is required — `PeriodicReader` drives export from a
     // background thread with no Tokio reactor), and same rationale as
     // `hive-metric` for the resource (the SDK reads `OTEL_RESOURCE_ATTRIBUTES`
-    // — set container-wide, see `docs/observability.md::Built-in resource
+    // — set container-wide, see `docs/scheduler/observability.md::Built-in resource
     // labels` — on its own; passing an explicit `Resource` here would need to
     // duplicate `agent`/`hive`/`swarm` this crate has no other reason to know).
     let exporter = MetricExporter::builder()

hive-agent/src/paths.rs

@@ -7,7 +7,7 @@
 //! Claude credentials live at `$HOME/.claude` (resolves to
 //! `/home/<agent-name>/.claude` because the harness service runs as a
 //! non-root unix user matching the agent label — see
-//! `docs/persistence.md::First-boot agent-user migration`).
+//! `docs/agent-lifecycle/persistence.md::First-boot agent-user migration`).
 //!
 //! All three paths can be overridden via env vars (`HYPERHIVE_STATE_DIR`,
 //! `HYPERHIVE_HARNESS_DIR`, `HYPERHIVE_CLAUDE_DIR`) for dev / test scenarios.

hive-agent/src/vacuum.rs

@@ -11,7 +11,7 @@
 //! Trade-off (accepted — issue tracker "perms borked"): a misbehaving harness
 //! could skip its own cleanup, which the host-side version was meant to
 //! prevent. But a compromised harness is already inside the container trust
-//! boundary (`docs/security.md`), and these are ephemeral local artifacts — so
+//! boundary (`docs/trust-boundary/security.md`), and these are ephemeral local artifacts — so
 //! the honest fix is to clean them up where they live.
 
 use std::path::Path;

hive-agent/src/web_ui/mod.rs

@@ -72,7 +72,7 @@ struct AppState {
 /// `HIVE_WEB_SOCKET` opt-in selects unix-socket vs TCP binding; the
 /// dual-mode transition + gateway-side consumer live in
 /// [`docs/web-ui/shape.md::Listener bind`](../../../docs/web-ui/shape.md) and
-/// [`docs/gateway.md::Per-agent unix-socket upstream`](../../../docs/gateway.md).
+/// [`docs/networking/gateway.md::Per-agent unix-socket upstream`](../../../docs/networking/gateway.md).
 ///
 /// # Errors
 ///
@@ -146,7 +146,7 @@ pub async fn serve(
     // `UnixListener` at the given path. Empty string treated as
     // unset so a stray `HIVE_WEB_SOCKET=` doesn't trap us into an
     // un-bindable empty path. Falls through to the TCP path below
-    // otherwise. See docs/gateway.md::Per-agent unix-socket upstream
+    // otherwise. See docs/networking/gateway.md::Per-agent unix-socket upstream
     // for the gateway-side consumer.
     if let Some(socket_path) = std::env::var_os("HIVE_WEB_SOCKET")
         && !socket_path.is_empty()
@@ -176,7 +176,7 @@ pub async fn serve(
 /// to ask.
 ///
 /// Marker-gating + the gateway-side consumer: see
-/// [`docs/gateway.md::Per-agent unix-socket upstream`](../../../docs/gateway.md).
+/// [`docs/networking/gateway.md::Per-agent unix-socket upstream`](../../../docs/networking/gateway.md).
 fn bind_unix(path: &Path) -> Result<tokio::net::UnixListener> {
     use std::os::unix::fs::PermissionsExt;
     if let Some(parent) = path.parent() {