docs(DEN-1413): define durable manifests on first install

[ORESoftware]

Summary

Adds architecture doc 24 for the first-install contract implemented in zed-pkg/zed-cli PR #42.

The document specifies:

• why normal zed install <package>... creates a durable .zpkg.toml when one is missing;
• the canonical --do-not-write-new-manifest escape hatch and environment variable;
• compatibility/deprecation behavior for --allow-no-manifest, --skip-manifest, and ZED_PKG_ALLOW_NO_MANIFEST;
• deterministic generated package identity, dependency, target, and adapter metadata;
• accidental-publication guardrails;
• atomic no-clobber writes, exact-content rollback, project-scoped locking, and concurrent first-install merging;
• conservative project-root inference;
• explicit frozen lock-only restore behavior;
• Linux/macOS, shell completion, failure, concurrency, and publication test requirements;
• the relationship to DEN-1411 Nix interoperability.

The README index now links doc 24 and marks implementation as in review.

Validation

• documentation link check: green;
• agents policy: green;
• repository hardening: green;
• formal review procedure: green;
• implementation PR Standardize polyglot clients, CLI dependencies, and monorepo boundaries #42 is review-ready at 9977e8a2eefef7b851c3ca4b548bd78bfc643934;
• pinned cross-org acceptance PR Document native and forge package release fanout #13 is green on Ubuntu 24.04 and macOS 15.

Linear: DEN-1413
Implementation: zed-pkg/zed-cli#42
Acceptance: zed-pkg-test/zed-pkg-e2e#13
Related: DEN-1411, DEN-567, DEN-772

[linear-code]

DEN-1413