[minor] Document managed ingress boundaries

[libops-agent]

Summary

• document the managed Cloudflare, Cloud Armor, router, IAM PPB, and Direct VPC request path
• define canonical client-IP and application-authorization trust boundaries
• document subnet sizing, MTU, IP retention, cold-start, and timeout contracts
• make signed digest and dependency promotion gates explicit
• distinguish managed depth-zero handling from self-hosted public PPB forwarding

Validation

• make docs-check
• Mint build and OpenAPI validation
• broken links, anchors, redirects, and snippets
• git diff --check

Merge only after every required CI check passes.