agent.css + docs: migrate icon sizing + popover :not([hidden]) prose (#713 batch 2)

agent.css carried 17 #NNN cookies, mostly attribution refs to the
#394 vibec0re overhaul (mara's full-screen redesign). Most were
not substantive WHY-prose — just "this exists because of #394"
breadcrumbs. The two genuine WHY-explanations move to docs.

Moved to docs/web-ui.md::Per-agent page:
- **Agent icon paragraph**: rewrote with explicit-em-sizing
  rationale (intrinsic <img> dimensions push parent flex container
  open via align-items: stretch height feedback) + the 5em ≈ 6em
  min-height - 0.5em padding × 2 derivation + align-self:
  flex-start sticks-to-top.
- **Overflow button paragraph**: added the :not([hidden]) display
  scoping rationale (UA stylesheet sets display:none on [hidden],
  but author display:flex would override — scope to :not([hidden])
  so the popover stays hidden until JS unhides).

Collapsed in agent.css: 17 cookies scrubbed across the file:
- #360 (full-screen vibec0re overhaul — closed) ×2: section
  header preface + side-panel section header
- #394 (vibec0re header redesign — closed) ×7: header height,
  main column, agent icon, meta-nav, overflow trigger, two
  orphaned-style tombstones
- #411 (popover scoping + icon align-start — closed) ×2: icon
  sticks-to-top + overflow popover scoping
- #568 (OAuth code mask + reveal — closed) ×1: show/hide toggle
- #666 (ask→operator inline-answer slot — closed) ×1: slot
  styling (substance partly in PR #780 docs section)
- #559 (mark all read header row — closed) ×1
- #376 (inbox row layout — closed) ×1: long-message wrap
- #375 (tail pill z-index — closed) ×1: collision fix

agent.css: 17 → 0 refs (100% reduction, fully migrated).

docs/web-ui.md

@@ -807,13 +807,17 @@ Three fixed-position layers frame a full-viewport terminal:
 
 **Fixed-overlay header** (`<header class="agent-header">`): frosted
 glass — `backdrop-filter: blur` lets scrolled terminal rows show
-through. Three flex columns (#394 redesign):
+through. Three flex columns:
 
 - **Agent icon** (`<img class="agent-icon">`): fixed-size square
-  identity anchor (5em, `width: 5em; aspect-ratio: 1;
-  align-self: flex-start` — capped so a tall state-row doesn't
-  inflate the icon, #411). Falls back to the dimmed hyperhive mark
-  on load error.
+  identity anchor — `width: 5em; height: 5em` with explicit pixel
+  sizing so the `<img>`'s intrinsic (large) dimensions don't push
+  the parent flex container open via `align-items: stretch`-driven
+  height feedback. 5em ≈ header content area (header `min-height: 6em`
+  minus `2 × 0.5em` padding). `align-self: flex-start` keeps the
+  icon stuck to the top so a state-row line-wrap doesn't drag it
+  down with it. Falls back to the dimmed hyperhive mark on load
+  error.
 - **Main column** (`.agent-header-main`): two rows.
   - Row 1 (`.agent-header-title-row`): title (`<h2 id="title">`) +
     meta-nav (`<nav id="meta-links">`). Meta-nav renders
@@ -861,8 +865,11 @@ through. Three flex columns (#394 redesign):
     (POST confirm → `POST /api/logout`; SIGINTs any in-flight turn,
     wipes OAuth credential files, flips the agent to `needs_login`
     — session history preserved). All destructive actions require
-    one extra click to acknowledge (#394 — rare ops shouldn't live
-    in the primary state strip).
+    one extra click to acknowledge — rare ops shouldn't live in the
+    primary state strip. The popover's display rules are scoped to
+    `:not([hidden])` so the `[hidden]` HTML attribute's UA `display:
+    none` isn't overridden by the author CSS's `display: flex` —
+    the popover stays hidden until JS removes the attribute.
 
 `/api/state` is fetched once on cold load (+ while
 `status === 'needs_login_in_progress'`); all other updates arrive via