Document why WireGuard and SSH are complementary layers, add Flux
boundaries for the ground segment, shared var/ data paths in docs/06,
and a contributor guide with the required test-first workflow.
Bench and flight share one query channel, so debugging exercises the
production path daily. Grafana/Prometheus/exporter host ports become
env-overridable for shared hosts.