docs: centralize documentation under docs/

Move standalone repository docs from the root into docs/ and add a documentation index that links the moved docs and the code-local runbooks.

Update Markdown links, source comments, and the root entry points to the new locations. Keep README.md and AGENTS.md at the root as required entry points.

Assisted-by: DeepSeek Harness (deepseek-flash)

outputs/README.md

@@ -72,7 +72,7 @@ Problems:
       agenix secrets.
   - [ ] Maybe it's better to test every service separately, not the whole host?
 
-Full-host tests are tracked as WA-013 in [WORKAROUNDS.md](../WORKAROUNDS.md).
+Full-host tests are tracked as WA-013 in [WORKAROUNDS.md](../docs/WORKAROUNDS.md).
 `outputs/x86_64-linux/nixos-tests/idols-ruby.nix` is exported as
 `packages.x86_64-linux.ruby-nixos-tests`, but it is not a `checks` entry, so CI never builds it and
 nothing else runs it. What runs today is the eval set above with `just test`, plus one NixOS-driver
@@ -122,5 +122,5 @@ All the outputs of this flake are defined here.
 
 The tree lists the per-host sources and tests. The flake also exposes a `checks` output: every
 system has `eval-tests` and `pre-commit-check`, and `x86_64-linux` adds `security-exporters`, which
-imports the top-level `tests/security-exporters.nix`. See [`../SECURITY.md`](../SECURITY.md) for
-when to run it.
+imports the top-level `tests/security-exporters.nix`. See
+[`../docs/SECURITY.md`](../docs/SECURITY.md) for when to run it.

outputs/default.nix

@@ -136,7 +136,7 @@ let
       deployment
       # Colmena evaluates with nixpkgs' plain lib, which lacks the version the
       # flake's lib reports; without this the toplevel differs (`26.11pre-git`).
-      # Recorded as WA-042 in WORKAROUNDS.md.
+      # Recorded as WA-042 in docs/WORKAROUNDS.md.
       {
         system.nixos.versionSuffix = lib.trivial.versionSuffix;
         system.nixos.revision = lib.trivial.revisionWithDefault null;