docs: CLI navigation map (single source of truth)

[LukasWodka]

What

Adds docs/cli-navigation.md — the single source of truth for how a user moves through the CLI. Four Mermaid flowcharts (top-level map · the two gate chains · data ingest · resources) + an exit-code legend + cross-links + a "known gaps" section. Renders natively in the Files tab; it's text, so it's diffable and stays live via PRs (this PR is where we discuss flow changes).

Why

As the CLI grows we need one canonical, viewable, discussable picture of every path and where a user can end up — not a drawing in a tool nobody can diff.

Notable structural facts it surfaced (worth the team's eyes)

• Two independent gate chains — account commands need sign-in (user token); data / environment commands are auth-free w.r.t. login (kubeconfig + in-cluster token). Only client create and delete cross both.
• The home screen is stateless today — the status-aware redesign (home-screen-spec.md) is proposed, drawn dashed.
• delete (offboard) exits 0 even on a partial/degraded teardown — no non-zero "incomplete offboard" code; a real gap for automation.
• data ingest exit codes are non-monotonic in execution order (staging exit-7 fires before the token exit-5).
• resources is drawn dashed — feature branch (feat(resources): tracebloc resources — show this machine's allowance (SHOW; set deferred) (#143) #237/feat(resources): tracebloc resources set — guided compute budget (P2, wizard + GPU) (#143) #241), not yet on develop.

Docs-only; no code change.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only change with no runtime or code behavior impact.

Overview
Introduces docs/cli-navigation.md as the version-controlled, PR-reviewable map of how users move through tracebloc / tb: four Mermaid flowcharts plus exit-code table, recovery cross-links, and a known gaps section.

The top-level map groups account vs secure-environment commands, aliases, and hidden/back-compat routes. Chain A vs Chain B documents that account commands require a user token while data/environment commands use kubeconfig + in-cluster token without sign-in. Dedicated diagrams cover data ingest (wizard vs flags, local checks, staging, outcomes) and resources (show solid on develop; set and the status-aware home screen drawn dashed as not shipped / proposed).

The doc pins basis to develop @ 27c5392 and calls out review topics (e.g. offboard always exit 0, non-monotonic ingest exit codes).

^{Reviewed by Cursor Bugbot for commit 2bea591. Bugbot is set up for automated code reviews on this repo. Configure here.}