feat: documentation site, multi-cloud benchmarks, and harness fixes

[bryantbiggs]

Summary

• Full documentation site (Astro) with getting started, configuration, CLI reference, registry guides, design docs, and performance benchmarks
• Multi-cloud benchmark infrastructure: SSH replaces SSM, per-provider Terraform (bench/terraform/aws/), streamed output
• Benchmark harness accuracy fixes: source blob byte counting, instance metadata, proxy header handling, competitor config corrections
• Site assets: proper OG image (1200x630 with stats), favicon without corner artifacts, web manifest, WCAG AA contrast compliance (Lighthouse 100/100 across all categories)

Documentation site

• Landing page with feature highlights and benchmark stats
• Registry-specific guides (ECR, GHCR, GAR, ACR, Docker Hub, Chainguard)
• Design docs (engine architecture, benchmarks, watch mode, findings log)
• JSON-LD structured data, sitemap, robots.txt, 404 page with noindex

Benchmark infrastructure

Area	Before	After
Remote access	SSM Session Manager	SSH
CLI args	--instance-id, --region	--provider aws
Networking	Private subnet + NAT gateway	Public subnet, IP-locked SG
Progress	Poll progress file via SSM	Stream stdout over SSH
Results	SSM send-command	SCP
Terraform dir	bench/terraform/	bench/terraform/aws/

Harness fixes

• source_blob_bytes was 240,000x wrong (counted redirect bodies, not CDN data)
• Proxy now preserves multi-value headers (insert -> append) for quay.io v1 manifest compat
• regsync config switched from type:repository to per-tag type:image entries
• regsync explicit mediaTypes to avoid Docker v1 manifest fallback on quay.io
• 429 abort and --skip-registries flag for rate-limit resilience

Site assets

• OG image: 1200x630 with benchmark stats (8x faster, 60% fewer bytes, 0 rate-limit errors)
• Favicon: full-bleed gradient square (no rounded corners, no corner-fill hack)
• Separate logo-mark.svg for site header (rounded rect preserved)
• Apple touch icon and PWA PNGs: full-bleed for OS masking
• Web manifest for Android/PWA
• WCAG AA contrast: --pink and --color-text-on-dark-muted bumped to pass 4.5:1

Test plan

• cargo fmt --check && cargo clippy -- -D warnings && cargo test (200 tests pass)
• cd bench/terraform/aws && terraform init && terraform validate
• Lighthouse: Performance 100, Accessibility 100, Best Practices 100, SEO 100
• OG image renders correctly in link previews (iMessage, Slack, Twitter)
• Favicon renders without corner artifacts in browser tabs (light + dark mode)