Public RLS, grafana_ro policies, runner_progress trigger, doc polish

[atharvas]

Summary

• Public read-only RLS (00012) for repositories, pull_requests, candidate_containers, harbor_runs via the anon role.
• grafana_ro policies (00013) so the Grafana role can read through RLS, plus refreshed dashboard panels.
• runner_progress.updated_at trigger (00014) so upserts actually bump the timestamp and live runs are distinguishable from zombies.
• Docs: converted the four ASCII architecture diagrams to Mermaid (remote-access, monitoring, datasmith.agents.synthesizer, datasmith.resolution), rewrote docs/guide/remote-access.md with user/developer perspectives, and added a CLAUDE.md note mandating Mermaid for doc diagrams.
• Gitignore: exclude local artifacts (.claude/, backups/, jobs/, .python-version) and one-off run_*.py debug scripts.

Test plan

• make check (ruff, mypy, deptry) clean
• uv run pytest — 598 passed
• Confirm GitHub Actions green
• Apply migrations 00012-00014 against the host Supabase instance after merge