chore(docs+devops): cross-module doc sync + sprint archival moves + compose updates

Bundled pre-session doc + ops work:
- docs/modules/**: sync across advisory-ai, airgap, cli, excititor,
  export-center, findings-ledger, notifier, notify, platform, router,
  sbom-service, ui, web (architectural + operational updates)
- docs/features/**: updates to checked excititor vex pipeline,
  developer workspace, quick verify drawer
- docs top-level: README, quickstart, API_CLI_REFERENCE, UI_GUIDE,
  code-of-conduct/TESTING_PRACTICES updates
- docs/qa/feature-checks/: FLOW.md + excititor state update
- docs/implplan/: remaining sprint updates + new Concelier source
  credentials sprint (SPRINT_20260422_003)
- docs-archived/implplan/: 30 sprint archival moves (ElkSharp series,
  misc completed sprints)
- devops/compose: .env + services compose + env example + router gateway
  config updates

File-level granularity preserved.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/modules/cli/guides/airgap.md

@@ -32,6 +32,7 @@ Offline/air-gapped usage patterns for the Stella CLI.
   ```bash
   stella airgap import --bundle /mnt/media/mirror.tar --generation 12
   ```
+  Imported mirror-bundle metadata is written durably under `%LocalApplicationData%/stellaops/offline-kit/state/mirror-bundles`, so the import history survives fresh CLI processes instead of relying on process-local memory.
 - Check sealed mode status
   ```bash
   stella airgap status
@@ -45,6 +46,7 @@ Offline/air-gapped usage patterns for the Stella CLI.
 - Commands must succeed without egress; any outbound attempt is a bug—report with logs.
 - Hashes and signatures are verified locally using bundled trust roots; no OCSP/CRL.
 - Outputs are stable JSON/NDJSON; timestamps use UTC.
+- Mirror-bundle import metadata is persisted locally with deterministic ordinal ordering for content paths and bundle items.
 
 ## Exit codes
 - `0` success