feat(#1997): add prettier markdown formatter to treefmt

- .prettierrc: proseWrap=preserve (no prose reflow)
- .prettierignore: exclude hivectl-cli.md (auto-generated) + 11 docs
  with multi-line list-item continuations prettier would strip to col 0
  (CommonMark limitation in prettier's list handling)
- format 16 markdown files: cosmetic only (*→_, table alignment,
  heading normalisation) — verified no broken continuations, idempotent

docs/boundary.md

@@ -1,12 +1,12 @@
 # The operator/agent boundary
 
 Design rationale for hyperhive's two-principal trust model. The
-*implementation* work — container network isolation, the unifying
+_implementation_ work — container network isolation, the unifying
 gateway, core-daemon privsep — is tracked as `area:ops` issues on
 the forge.
 
 Today "the operator surface" and "the agent surface" are a
-*convention*, not a boundary — nothing stops a container from
+_convention_, not a boundary — nothing stops a container from
 curling the core daemon on `localhost:<port>`, or another agent's
 web UI. Network isolation, the gateway, and privsep together turn
 that convention into an enforced boundary.
@@ -19,7 +19,7 @@ that convention into an enforced boundary.
   lifecycle POSTs) are served by the core daemon and only
   reachable via the gateway.
 - **Agent** — speaks only for itself, only over its per-agent
-  unix socket. The socket's identity *is* the agent (see
+  unix socket. The socket's identity _is_ the agent (see
   `docs/conventions.md`, "identity = socket"). An agent must not
   be able to reach the core daemon's HTTP surface, another
   agent's socket, or another agent's web UI.
@@ -30,7 +30,7 @@ that convention into an enforced boundary.
 point.** They live on the core backend.
 
 Worked example — answering an operator-targeted question is a
-`POST /answer-question/{id}` on the core dashboard, *never* an
+`POST /answer-question/{id}` on the core dashboard, _never_ an
 `AgentRequest` variant. If it were a per-agent-socket request, an
 agent could `curl` its own socket and spoof an operator answer.
 The per-agent web UI POSTs cross-origin to the core for these
@@ -44,7 +44,7 @@ container can reach `localhost:<core-port>`, the dashboard, and
 every other agent's web port. Until that changes, the
 operator/agent split is on the honour system — every boundary
 claim above is aspirational. Network isolation is what makes the
-boundary *real*; the gateway and privsep are ergonomics and
+boundary _real_; the gateway and privsep are ergonomics and
 defence-in-depth layered on top.
 
 The `area:ops` issues followed this sequencing: