docs: add README, Sphinx docs site, and Pages + docs-branch publish

[lacraig2]

What

igloo_driver had no documentation — no README, no docs site. This adds all three, mirroring how Penguin publishes its docs.

1. README.md

What igloo_driver is — an in-guest programmable kernel debugger for IGLOO/Penguin rehosting (read/write kernel & user memory, OS introspection, kprobe/uprobe/syscall/signal hooks, kernel-function FFI, and synthesized /proc·/sys·/dev·sysctl·MTD pseudo-files, all over the Portal shared-memory protocol on a per-arch hypercall). Includes the build.sh quickstart, repo layout, and links into the deeper docs and into Penguin's host-side API docs.

2. docs/ — Sphinx + MyST site (furo)

Hand-authored conceptual pages:

• architecture — module layout, init order, analysis scoping
• portal — the full 49-op catalog grouped into 8 families + the shared-region protocol + response codes
• hypercall_abi — the per-architecture trap-instruction table + hypercall-number families
• hooks — syscall filtering, signal drop, ioctl/uname/mount/open
• hyperfs, pseudofiles, building

Plus a C API reference auto-extracted from src/ by Doxygen and rendered through Breathe. conf.py runs Doxygen itself, so a bare sphinx-build docs/ _build/html is fully self-contained. The build is warning-clean under -W.

3. .github/workflows/docs.yaml — build + dual publish

Builds the HTML (plain sphinx-build; Doxygen via apt) and publishes it to both:

• GitHub Pages (configure-pages → upload-pages-artifact → deploy-pages@v4)
• a generated-only docs branch (peaceiris/actions-gh-pages@v4, force_orphan, .nojekyll) — the git clone --branch docs served-directly path

The deploy_static job is lifted near-verbatim from Penguin's docs.yaml, including the stale-artifact cleanup.

Key design choices

• Plain sphinx-build, not a containerized build. Penguin builds docs from its live runtime image to introspect Python plugins; a C kernel module has no such path, so a static build is correct and simpler.
• Trigger = push-to-main (paths: docs/**, src/**, README.md, workflow) + workflow_dispatch — not workflow_run-after-release. Docs depend only on docs/+src/, not on the heavy multi-arch module build, so they stay decoupled (Penguin's intent, adapted).
• HTML only, no PDF. Penguin's PDF is a release asset; igloo_driver's releases come from the separate module-build workflow this trigger is decoupled from, so a PDF has no natural home. LaTeX config remains in conf.py for local make latexpdf.

Verification

• sphinx-build -b html -W --keep-going docs docs/_build/html → exit 0, zero warnings (the exact CI command). Breathe-extracted symbols confirmed rendering (igloo_in_scope, get_target_task_mm, HYPER_OP, igloo_hypercall4, OSI structs).
• Workflow YAML validated.

One-time repo setup needed for the deploy to work

• Settings → Pages → Source = "GitHub Actions" (required by deploy-pages).
• The docs branch is auto-created by peaceiris on first run — do not hand-edit/push it.

The workflow is exercisable via workflow_dispatch once merged.