docs: restructure into topic subdirectories, collapse duplicated index

Per mara's go-ahead on hyperhive#3902 ("getting started is good, but
terminal rendering does not go in there i think"):

Moved 21 top-level docs/*.md files into 7 new topic subdirectories
(existing web-ui/, turn-loop/, swarm/, tools/, crates/ untouched):
  getting-started/  setup.md
  agent-lifecycle/  agent-hierarchy.md, approvals.md, persistence.md
  trust-boundary/   boundary.md, security.md
  integrations/     forge.md, matrix.md, github.md, knowledge.md
  networking/       gateway.md, network.md, snapshot-store.md
  scheduler/        jobq.md, coordinator.md, ci.md, observability.md
  process/          conventions.md, gotchas.md, pr-review-gate.md
  web-ui/           terminal-rendering.md (moved into the EXISTING dir,
                    per mara's correction to the original getting-started
                    guess -- it's UI implementation detail, not onboarding)

The physical layout now matches docs/README.md's own topical headers,
which already amounted to this taxonomy -- see the scoping comment on
the issue for the two findings that motivated this (a genuine
duplication between CLAUDE.md's old "Reading paths" list and
docs/README.md's grouped one, since drifted out of sync with each
other; and the flat layout not matching the grouping we already had).

Fixed every cross-reference this moved across the whole repo (~120
files: docs/ internal links at every depth, Rust doc comments, nix
module option docs, crate READMEs) -- verified two ways: a grep sweep
confirming zero remaining references to any old path, and a script
that resolves every markdown link in docs/**/*.md + CLAUDE.md +
README.md against the filesystem and reports anything that doesn't
exist (zero broken links).

Collapsed CLAUDE.md's "Reading paths" section (the duplicate) down to
a pointer at docs/README.md, now the single index. Rewrote
docs/README.md itself to use the new subdirectory paths and added the
one doc it was missing that CLAUDE.md's old copy had (pr-review-gate.md).

Classified all 22 docs/*.md files first via a haiku subagent (mara's
suggestion) on two axes -- proposed grouping and operator-vs-
implementation focus -- before finalizing the taxonomy; spot-checked
the report and found internal inconsistencies (its classification
table disagreed with its own summary section for a few files), so this
taxonomy is my original proposal + the one correction mara gave
directly, not a blind application of the subagent's table. The
operator-focus data it gathered is still useful for a follow-up
content pass (docs skewing 'mixed' rather than pure operator-facing),
not addressed in this PR -- structure only.

nix fmt clean, both pre-push lints clean.

hive-c0re/src/lifecycle/host_config.rs

@@ -85,7 +85,7 @@ fn config_bind_source(name: &str) -> PathBuf {
 }
 
 /// Append bind flags for `child`'s state and config dirs into `binds`.
-/// See docs/persistence.md ("Parent access to child state") for what a
+/// See docs/agent-lifecycle/persistence.md ("Parent access to child state") for what a
 /// parent may touch and why. Creates missing host-side directories so
 /// nspawn doesn't refuse to start; missing dirs are non-fatal.
 ///
@@ -134,7 +134,7 @@ fn bind_child_agent_dirs(child: &str, binds: &mut Vec<BindMount>) {
 /// that hive-c0re owns: `PRIVATE_NETWORK` (always 1), `HOST_ADDRESS` (the
 /// bridge gateway IP) and `EXTRA_NSPAWN_FLAGS` (the runtime-dir bind). What
 /// those network vars mean and why isolation is unconditional:
-/// `docs/network.md` § *What the Rust side does*.
+/// `docs/networking/network.md` § *What the Rust side does*.
 ///
 /// ⚠️ The start script expands `$EXTRA_NSPAWN_FLAGS` unquoted into the
 /// `systemd-nspawn` command.

hive-c0re/src/lifecycle/mod.rs

@@ -94,7 +94,7 @@ pub fn agent_web_port(name: &str) -> u16 {
 ///
 /// `HIVE_NETWORK_SUBNET` carries the host-side bridge address verbatim
 /// (e.g. `10.42.0.1/24`), **not** the canonical network address — see
-/// the note in `set_nspawn_flags` + `docs/network.md`. The IP part is
+/// the note in `set_nspawn_flags` + `docs/networking/network.md`. The IP part is
 /// therefore the bridge IP itself: the host end of the bridge, the
 /// default-route target for isolated containers, and the address the
 /// hive dnsmasq resolver binds. Returns the dotted-decimal IP with the
@@ -522,7 +522,7 @@ pub async fn converge_start_preamble(
 /// activation-error shape), retry once via stop + kill + start before
 /// giving up. Used by the queue's fast-lane `Start` handler and the
 /// inline start-after-rebuild path.
-/// See `docs/coordinator.md::Cold-start fallback`.
+/// See `docs/scheduler/coordinator.md::Cold-start fallback`.
 ///
 /// Requires a [`StartableAgent`] token from [`converge_start_preamble`]
 /// to prove the preamble ran. For internal use within this module (where
@@ -701,8 +701,8 @@ pub async fn destroy(name: &str) -> Result<()> {
 /// Pre-build `system.build.toplevel` against `meta#<name>` so the
 /// subsequent `nixos-container update` finds the result cached and
 /// skips straight to the profile-swap. Store-warming only — container
-/// is untouched. See `docs/coordinator.md::Rebuild path` for why
-/// the prebuild happens before stop, and `docs/coordinator.md::Prebuild
+/// is untouched. See `docs/scheduler/coordinator.md::Rebuild path` for why
+/// the prebuild happens before stop, and `docs/scheduler/coordinator.md::Prebuild
 /// attr path` for why the explicit nixosConfigurations attr is required.
 ///
 /// `node_id` is the queue node this build belongs to, when there is one —