Fix documentation defects found by an adversarial review

Fifteen findings, all verified before acting. The ones that mattered:

- Corrections added without updating what they corrected. §5's table still
  said a cap-less NURI is one "without :k:", two hundred lines after §4
  established the discriminant is `r:`. Same shape of defect in the P1a
  report, which kept the sentence "it is the owner's keyring, upstream the
  keyring is the wallet" — the exact sentence §4quater declares wrong, and the
  one that produced a global in-memory keyring.

- A wrong source citation: RootCapRefresh/BranchCapRefresh live in
  verifier/src/commits/mod.rs, not repo/src/commit.rs, and are no-op stubs.

- Documentation describing deleted code: isolation.ts, discovery.readIndex,
  the global index, and an acceptance test that was dropped with discovery.

- The P1a implementation report had aged into being wrong in four places
  (caps not persisted, inbox processing not started, plain string types, the
  :k: segment). It is dated, so it now carries a header saying what later lots
  overtook, rather than being rewritten.

- vision.md stated "a document's data is stored encrypted" in the present
  tense. That is the target; here the cap value is the constant OK and nothing
  is encrypted. Said plainly now.

- Prose left mangled by an earlier mechanical find-and-replace, in four places
  I had claimed were repaired.

Also: reach.ts and connect.ts had no home in the permanent docs — the boundary
and the connection sequence are now described in simulation.md, not only in a
brief.

packages/client/test/cross-user-access.test.ts

@@ -14,7 +14,7 @@
  *     inbox files it, which fires the held-caps signal, which re-runs the read — the
  *     protected document appears with nothing else happening.
  *
- * The difference between Bob and Charlie is ONLY what what they hold holds. There is
+ * The difference between Bob and Charlie is ONLY each of them holds. There is
  * no authorization list anywhere, and nobody was named to the registry.
  */
 import { test, expect, mock, afterAll } from "bun:test";
@@ -257,7 +257,7 @@ test("Charlie: same public document, same reference — and he reads through it"
   expect(await readValues([ref], SECRET)).toEqual(["the-protected-content"]);
 });
 
-test("the ONLY difference between Bob and Charlie is what what they hold holds", async () => {
+test("the ONLY difference between Bob and Charlie is each of them holds", async () => {
   inject();
   const { protDoc, pubLink, protCap } = await aliceSetsUpHerDocuments();
   const CHARLIE_INBOX = await walletInbox("charlie");