fix: stabilize pilot installation and dependency builds

[ericpaulsen]

Summary

Pilot setup mixed required installation with optional capture and maintainer release checks. Order the guides around prerequisites, configuration, startup, verification, and enrollment, following Coder's installation structure. Shorten the quickstart and move hook details after setup.

Fix pinned checkout and upgrade steps, per-client credentials, CLI installation, environment loading before agent startup, API readiness retries, gateway configuration before startup, and Session verification. Keep the synthetic rehearsal in the release guide; installing an approved build uses its release evidence plus live deployment checks. Preserve the rehearsal's executable documentation tests at its new location.

Fresh client installations also resolved unreviewed SQLAlchemy 2.1, and Wolfi's
OpenSSL transition broke gateway builds. Bound SQLAlchemy to 2.0 and pin the
gateway's existing reviewed OpenSSL and supporting packages. No security gates
or exceptions change.

Closes #106

Architecture check

Documentation, documentation-test paths, and dependency constraints change. No domain behavior, schema, or security policy changes.

Checklist

• Ruff lint and format checks
• SPDX check
• 140 focused tests for enrollment, Compose configuration, installer behavior, and documentation contracts
• Quickstart end-to-end test and 14 demo tests against disposable PostgreSQL 17
• 72 focused release/security contract tests and 8 gateway runtime tests after the dependency fix
• Fresh wheel installation passes the client security scan locally and on Ubuntu; both gateway architectures build in GitHub Actions
• Full Python suite on the final commit; CI is running
• Documentation links, publication coverage, and generated references
• Syntax checks for 123 shell, 2 JSON, and 2 TOML examples; 70 Sediment commands parsed without execution
• Private environment generation and Compose override loading verified without starting deployment services
• Locked pi runtime verified under Node 24

Shim changes, library logging, and cloud-import checks are not applicable.

Remaining release blockers

• Hugging Face Hub 2.0.0 is the latest supported release. Every released Tokenizers version accepted by LiteLLM 1.102.1 requires Hub below 2.0. A real dependency resolution confirms the conflict. See Hub's released security policy and Tokenizers metadata. The supported gateway dependency set needs a compatible upstream release or a separately maintained compatibility patch.
• Production input changes invalidate the existing vulnerability-review source fingerprints. They remain unchanged pending the independent maintainer approval required by docs/operate/security.md. The manual security run collected both architectures and preserved the failing gates. The client check passes; image builds succeed, but disposition fingerprints and the gateway support-policy conflict block security acceptance.

Notes for reviewers

Independent reviews checked command order and claims against the implementation. Fixed the environment reload and container-test scope findings. The quickstart test needed the host's existing libpq tools on PATH. Live pilot deployment, real agent capture, and a full release rehearsal were not exercised locally.

An independent review confirmed the dependency fixes preserve security checks and verified the unresolved upstream compatibility constraint. CI is not green.