docs: add context-layer design spec (refs, aliases, packs, onboard, pickers)

[timimsms]

Summary

Adds docs/design/context-layer.md, the accepted design spec for the cu context layer: named refs and saved queries compiling onto the #25 Filtered-Team-Tasks endpoint, gh-identical aliases with registration-based dispatch, declarative-inert packs whose entire trust model is a manifest-wide sha256 with semantic-diff re-consent (SHA-pin authority, git fetch hardening, credential-key blocklist, source TOFU, 0600 tamper-evident lockfile), the cu onboard wizard, and bubbletea-backed pickers with a plain-stdout cu pick contract. The doc folds in all fact-check corrections (real config.yaml filename, $CU_CONFIG_DIR marked as future, -w/--workspace and bulk --list labeled as new surface, corrected export example, non-vendored SDK wording) and includes the dependency-ordered S/M/L sequencing ladder. It lives in docs/design/ — deliberately outside docs/site/ — so it does not publish to the mkdocs site; mkdocs build --strict verified green with the new directory present.

Maintainer decisions (final; spec §9.1)

1. The wizard is cu onboard, not cu init — onboard joins the reserved-now list, init moves to future-reserved; happy side effect: no confusion with the existing cu config init.
2. No shell (!) aliases in packs — packs are 100% declarative-inert. The manifest parser rejects ! aliases at install (fail-closed, loud error); the grant machinery is deleted entirely; the lockfile becomes source/pin/rev/manifest_sha256 (+ trusted_projects); the project .cu.yml TOFU gate stays; cu pack info gains a static capability report; escape hatches are project .cu.yml, cu-<name> PATH extensions, and a future declarative url: alias type. Pack work resized L → M.
3. bubbletea/bubbles in core accepted as specced.
4. Future-reserved word list approved (with the init/onboard swap) as an API commitment; cu which --reserved stays.
5. Root cu @ref sugar kept, with an explicit cut line: if @-parsing complicates cobra arg/completion handling, the fallback is requiring cu task list @x.

Related issues

• config: project .cu.yml merges via viper.Set and Save() writes merged state back to global config #37 — config layering bug (viper.Set precedence inversion + Save() global-config corruption): the keystone P0 prerequisite (spec §2.5).
• Context layer: refs, aliases, packs, cu onboard, pickers #38 — Context layer tracking epic (four layers, sequencing ladder, maintainer decisions).

🤖 Generated with Claude Code