Docs: make AGENTS.md the release source of truth, and fix the chatbot's route docs

[lovestaco]

Summary

Two related pieces of documentation work, plus one small UI fix.

1. AGENTS.md is now the single source of truth for the release process. The internal flyweight wiki page "LiveReview: Publishing Updates for the Self-Hosted Version" can be deleted once this merges — everything still accurate from it has been folded in here.

2. The chatbot's route documentation (internal/docindex/docs/routes_guide/) was audited against the actual code, after Livi gave a user a wrong answer about onboarding a team member. Several factual errors turned out to be feeding it.

Release process (AGENTS.md)

• Document make docker-multiarch-push ARGS="--latest --version vX.Y.Z" as the explicit non-interactive form, and --no-latest for backport tags that must not move :latest.
• Document the interactive targets (docker-interactive-multiarch*), note that both paths converge on the same build_docker_image() call, and record the two real differences: --tag vs --version, and that lrops.py docker validates the tag exists while build --docker does not.
• Require agents to ask which mode to use rather than choosing.
• Add a gotcha about disk space during multi-arch builds.

The wiki's docker --context gitlab steps were not carried over — that context was removed in 2825a9b.

Route docs audit

Checked every file on four axes. Route paths, component paths, and internal links were all correct; access/permission claims were wrong in six places, all the same way — docs said "super_admin only" for things org owners can also do:

File	Was	Actually
settings/instance.md, settings/storage.md	super_admin only	canManageInstanceConfig — super_admin or a self-hosted org owner
settings/deployment.md, settings/smtp.md	super_admin only	canManageCurrentOrg — owner or super_admin
settings/license.md	"super_admin (cloud)"	Tab is absent in cloud (!isCloudMode())
reports/*	mixed	APIs are any-org-member; only the mega menu is owner/admin-gated

Content fixes:

• reports/onboarding-report.md described the wrong page. It claimed to track "who has/hasn't onboarded (installed CLI, connected AI provider, run a first review)". It doesn't — it's a 57-chart org analytics report (adoption, repos, engineers, quality, cost, engagement) with an async PDF/HTML export. The per-person checklist actually lives on the Dashboard. That name collision is what produced the bad answer.
• dashboard.md omitted DashboardGrid entirely — the entire 13-widget chart grid was undocumented. Now covers the period selector, per-user layout persistence, and how to read each chart plus where it drills through.
• reports/taxonomy-reports.md: the three modes, the URL-parameter filters that make mega-menu deep links work, /summary fields, and the CSV/XLSX dataset exports.
• settings/integrations.md: replaced a four-line stub with the real Slack / Teams / Discord setup steps as the UI presents them.
• Per-seat licensing is deprecated, but subscribe.md, licenses/license-management.md, and settings/plan-and-usage.md still described the seat flow as the current way to make room for a teammate. Reframed; seat UI is marked legacy.
• Added a Learn more (public docs) section to 15 files. Every URL was verified against the synced hexmos_docs/ corpus, so none 404. The convention is recorded in README.md.

UI change

IntegrationsTab.tsx: removed the "Download the Livi icon" step from the Teams flow (Teams branding comes from the uploaded app package) and renumbered the remaining steps — they previously rendered 1, 2, 3, 4, 6, 7, 8, skipping 5. Azure Portal link normalized to a trailing slash.

Testing

No UI build was run (per repo convention). Verified by static checks:

• All route paths cross-checked against App.tsx and the nested routers.
• All ui/src/... component paths in docs confirmed to exist.
• All internal markdown links resolve.
• All public-docs URLs map to a real page in hexmos_docs/.

Security scans, all clean:

• make security-gitleaks — no leaks (2321 commits)
• make security-osv — clean
• make security-govulncheck — 0 vulnerabilities called
• make security-semgrep — 2 WARNING findings, both reviewed and false positives (a gojq JSON round-trip flagged as CWE-502, which doesn't apply to Go's encoding/json; and a dev-only script's urllib call whose URLs are all hardcoded literals)

Follow-ups not in this PR

• A LawBook rule (e.g. livi.answering.licensing) so Livi never invents a purchase flow, rather than depending on the right chunk being retrieved.
• A task-oriented "onboard a team member" doc, so the sequence isn't reassembled from four route pages each time.
• A test asserting the Settings tab-id → gating table matches Settings.tsx — the drift behind all six wrong access claims would then fail CI instead of reaching users.
• The Onboarding Report has no mega-menu entry, reachable only via a link on /reports. Documented as such, but it may warrant a menu entry.