Restore the docs signpost and fix the bench lockfile

[kingchenc]

Two gaps that came out of holding the tree against the blueprint path by path
rather than against the checker, which could see neither of them.

The signpost in docs/

Section 01 lists docs/README.md as a file both repositories carry, and says
what it prevents: someone starting a second documentation tree in the main
repository. That is what happened here. docs/ holds three real documents and
nothing that says where the rest lives, so a reader who opens the directory has
no reason to think a site exists at all.

The blueprint even anticipated it — the row reads "In wickra-backtest liegen
daneben drei echte Dokumente" — and check_blueprint.py still reported the root
inventory complete, because docs/README.md was missing from its ROOT list.
Fixed on the tooling side too, so the next repo cannot hide the same gap.

The new file names both directions. The per-language API reference is on
backtest.wickra.org, one page per language surface; the Rust API is on docs.rs.
What stays here is what a release can change and what this repository owns: the
spec reference beside its JSON schema, the cookbook beside the strategies it
explains, the microstructure guide beside the engine implementing it. It closes
with the rule that keeps it a signpost — a page about calling the library from a
language belongs on the site, a page about what the engine accepts belongs
beside the code.

Site URLs verified against the site's own .vitepress/config.ts (cleanUrls: true, links of the form /api/rust) rather than guessed.

bench.yml has been red for three nights

2026-08-28, -29 and -30, all with the same error, and nobody saw it because the
workflow only runs on a schedule and nothing watches a scheduled workflow:

ERROR: In --require-hashes mode, all requirements must have their versions
pinned with ==. These do not: pexpect>4.6 (from ipython==9.16.1)

The lock was compiled on Windows. ipython requires pexpect only where
sys_platform != "win32", so that branch was never taken and pexpect never
entered the file. On the ubuntu runner pip needs it, finds it unpinned, and
--require-hashes refuses the entire install — so not one benchmark ran on any
of those nights.

--python-platform linux fixes it at the source, and update-lockfiles.sh now
carries the reason, because the next person regenerating this on a laptop would
otherwise undo it silently. bench.yml runs on ubuntu and nothing else, so the
lock is built for ubuntu and nothing else.

The diff is the whole story: +pexpect, +ptyprocess, and the Windows-only
colorama and tzdata drop out of a file that only ever installs on Linux. No
other version moved — uv keeps existing pins as preferences.

The two ci-dev locks are deliberately untouched. They install on all three
runner operating systems, so resolving them for one would be the same mistake in
reverse. Measured rather than assumed: neither carries a platform-conditional
requirement, which is why both have been green on all three all along.

Verification

• Dependency closure of the new lock is complete — 21 via sources, every one
  pinned — and all 61 packages carry hashes.
• actionlint (with shellcheck), check_readme_links, check_version_sync,
  check_example_specs, check_license_copies: green.
• Every relative link in the new file resolves to a path that exists.
• Blueprint checker after this: 82/82, no finding. The counterpart run
  against wickra stays at 88/88 with every conditional check still firing
  there, so nothing was weakened to reach it.

Not attempted, and named rather than left implied: the R vignette, r/data,
data-raw, the node harness.js / dts-header.d.ts polish, gen_golden_test.py
and the extra example scenarios. All are marked wickra-only in the blueprint,
and §08 says the matrix is filled as needed rather than in full. Writing them
here would be inventing product content, not closing a gap.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!