Document enrollment, OAuth login, verification, service installation, and recovery for a TMB-backed CI auth-agent.
- add the end-to-end operator workflow to the CI authentication guide
- describe the trust boundary between
tng, the TMB, the PDS, and the worker VM - document named instances, owner-only local state, and service lifecycle commands
- add recovery guidance for expired or revoked sessions
- regenerate the published DocC command reference
This documents the complete operational workflow introduced by the preceding pull requests.