[minor] Document the portable LibOps architecture

[libops-agent]

Summary

• define ownership across Buildkit, Compose templates, core sitectl, application plugins, cloud-compose, and the managed control plane
• document bundled versus Composer-owned application images and safe downstream-fork/component boundaries
• add self-hosting, Direct VPC egress, release compatibility, state, secret, backup, and recovery guidance
• move command-specific guidance to the canonical sitectl documentation instead of maintaining conflicting copies

Verification

• make docs-check
• Mint build and OpenAPI validation
• broken links, anchors, redirects, and snippets
• secret-pattern and whitespace checks