docs: modernize SagaSmith Agent operations guide

[dajiaohuang]

Summary

• make the Chinese and English root READMEs the operational entry point for Local Kit, Hosted Worker, and external Host bridge deployments
• document the actual MCP 2026-07-28 discovery/auth/Tasks contract, current-system connection, bounded per-turn tool projection, and standard CallToolResult media preservation
• document the exact Hosted trusted-context fields, token separation, workspace ownership/TTL/LRU/capacity behavior, low-cardinality metrics, and safe upgrade/rollback order
• align the docs index, architecture, deployment/security guidance, Local Kit templates, bundled WebUI/Skills, and workspace README surfaces with the current release lock and authority boundaries
• replace the stale SagaSmith Web repository link

Evidence checked

• nanobot/apps/hosted_worker.py and nanobot/apps/hosted_workspace.py
• nanobot/agent/tools/mcp.py, nanobot/agent/mcp_tasks.py, and auth-context/observability code
• nanobot/config/schema.py, sagasmith-local-kit.json, and sagasmith-stack-lock.json
• Local Kit templates, Hosted/Local Dockerfiles, CI lanes, CLI help, and focused contract tests

Validation

• local Markdown links across all 13 changed surfaces: passed
• git diff --check: passed
• diff credential/private-key scan: passed
• ruff check nanobot tests: passed
• focused Hosted/MCP/workspace/release-lock tests: 65 passed
• tests/host_conformance: 29 passed, 37 skipped (real-domain lanes require their CI environment)
• nanobot sagasmith install|doctor|benchmark|start --help: passed
• nanobot.apps.hosted_worker --help: passed and matches documented workspace flags/defaults

The Hosted distribution audit is intentionally described as a clean-image check: an all-extras Local/dev environment contains Channel SDKs and therefore fails that audit by design.