fix(docs): add a README Context section and the architecture doc

[catinspace-au]

Two gaps here, and they are related. The README had nowhere to put the working guide, and there was no architecture doc at all -- so the startup ordering rules and the PKI traps existed only as comments inside the modules that implement them, which is the last place someone about to break one will look.

docs/architecture.md is new. It covers what is in the image and how each third-party binary is verified, the entrypoint's ordered startup sequence, the two iptables chains plus the four ordering rules that hold them together, and the three PKI invariants you cannot guess from the code's shape -- why easyrsa init-pki is never called, why a fetched tls-crypt-v2 key is fatal to miss rather than something to mint around, and why CRL refresh cannot be shared between the two PKI modes. Every claim came out of the Dockerfile, scripts/entrypoint.py, scripts/lib/network.py and scripts/lib/pki.py.

The README's ## Context is its last section now, and nothing else in the file moved. The Don't/Do/Why rows are all real history, not advice: the skip-CI marker that kills a run when it appears anywhere in a commit message, hand-editing the generated chart, easyrsa init-pki and issue #11, doc-link case against git ls-files, and reading a green PR as proof the image starts.

docs/README.md gains the index entry. That is not tidiness -- tests/unit/test_docs_links.py fails the suite on any doc the landing page does not link, and it also compares link case against git ls-files, so an unstaged new file reads as a broken link. It caught both while this was being written, which is why the bite row about it is in there.

Proof

tests/unit/test_docs_links.py -- 5 passed. The wider unit tier is 467 passed, 3 failed.

The three failures are not from this change. They are issue #38 doing exactly what that issue says it does -- firing on the next unrelated PR, where it looks like that PR broke something. On main right now deploy/helm/culvert/Chart.yaml carries appVersion: "v2.1.14" while VERSION says 2.1.15, because the v2.1.15 release commit stamped VERSION and the changelog without re-rendering the chart. This branch touches README.md, docs/README.md and docs/architecture.md and nothing else, none of which those tests read.

So helm install from main is deploying the previous image. Worth deciding on its own rather than being hand-bumped inside a docs PR, since a hand-bump is what #35/#36/#37 already did once and the drift returned on the next release.

NOT verified: the integration, e2e and k8s tiers were not run here. The README is also over the house length ceiling at 1755 words and 14 sections before ## Context, which predates this change and would mean splitting a public product page by reader intent.

[catinspace-au]

Merging with ci / Test red, on purpose, and here is the reason so nobody reads it as a pass.

That failure is issue #38 firing, not this change. On main, deploy/helm/culvert/Chart.yaml carries appVersion: "v2.1.14" while VERSION says 2.1.15. This diff is three markdown files and touches none of Chart.yaml, VERSION or CHANGELOG.md. ci / Quality passed (41s).

The live consequence is worth restating: helm install from main deploys the PREVIOUS image right now.

Hand-bumping the chart has already been done once across #35, #36 and #37, and the drift came back, so a fourth hand-bump is not the fix. The two that would hold:

1. Make the release commit re-run scripts/generate-deploy-artefacts.py, so the chart cannot lag the version it ships.
2. Run the artefact check ON the release commit rather than skipping it there.

(1) kills it at source. Not folded into a docs PR.

Also, while in here: #29 and #33 were closed today as superseded by #34, which takes openvpn-auth-oauth2 to v2.2.0 -- the current release, past the cooldown. #34 is still open and its own test job fails with logs aged out.

[github-actions]

Released in v2.1.16 — https://github.com/hyperi-io/culvert/releases/tag/v2.1.16