docs: split context into layered, agent-oriented files

Replace the single file-structure.md with a stratified layout designed
for AI/agent skill consumption: tables and concrete identifiers over
prose, files loaded on demand, content separated by churn rate.

Layers:
- architecture/  stable structural reference (overview, source-map,
                 test-map, data-flow)
- patterns/      memory, commands, autocomplete, events, xmpp,
                 encryption, ui, plugins
- testing/       unit-tests, stubs, functional-tests, bench
- build/         local, docker, ci
- playbooks/     add-command, add-test, add-autocomplete,
                 add-event-handler, add-encryption
- gotchas.md     append-only dated entries (seven seed entries)
- wip/           branch-specific notes; deleted on merge to master

Stable layers describe cproof on master only. In-flight feature
branches (currently feat/ai) get a single file under wip/.

INDEX.md is the entry map with churn labels; SKILL.md is the
always-loaded skill hint pointing to it.

build/docker.md

@@ -0,0 +1,75 @@
+# Docker build
+
+Canonical build environment. **Use this; do not build on the host.**
+
+## Dockerfiles
+
+All at repo root:
+
+| File | Base | Purpose |
+|---|---|---|
+| `Dockerfile.debian` | `debian:testing` | **Canonical.** Mirrors CI for Linux. |
+| `Dockerfile.ubuntu` | `ubuntu` | Alternate Linux for compatibility checks. |
+| `Dockerfile.fedora` | `fedora` | Fedora compatibility. |
+| `Dockerfile.tumbleweed` | `opensuse/tumbleweed` | openSUSE compatibility. |
+| `Dockerfile.arch` | `archlinux` | Arch CI matrix. |
+
+Default: `Dockerfile.debian` for local dev, build, and `make check`.
+
+## Build the image
+
+```sh
+docker build -t cproof-debian -f Dockerfile.debian .
+```
+
+`Dockerfile.debian` installs the autotools toolchain plus all optional
+dependencies (cmocka, libsignal-protocol-c, libotr5, gpgme, libcurl,
+libmicrohttpd, libnotify, ncurses, GLib, libgcrypt, libreadline, libssl,
+Python). Treat its `apt-get install` block as the authoritative dependency
+list.
+
+## Build cproof inside the container
+
+Bind-mount the working tree and run the autotools sequence:
+
+```sh
+docker run --rm -it \
+    -v "$PWD":/src -w /src \
+    cproof-debian \
+    bash -c './autogen.sh && ./configure && make -j$(nproc)'
+```
+
+For tests:
+
+```sh
+docker run --rm -it \
+    -v "$PWD":/src -w /src \
+    cproof-debian \
+    bash -c './autogen.sh && ./configure && make -j$(nproc) check'
+```
+
+`ccache` is enabled in the image (`CC="ccache gcc"`) — share a ccache volume
+between runs for faster rebuilds:
+
+```sh
+-v "$HOME/.ccache":/root/.ccache
+```
+
+## Why Docker
+
+- Pinned OS + package set; the same toolchain CI uses.
+- Host glib / openssl / libstrophe drift cannot mask or invent failures.
+- Encryption-stack dependencies (libsignal-protocol-c especially) are
+  awkward on host package managers; the image already has them.
+
+## When to use a non-Debian image
+
+- Reproducing a CI failure that only triggers on Arch / Fedora / Ubuntu /
+  Tumbleweed. Use the matching Dockerfile, same bind-mount pattern.
+- Otherwise: stick with Debian.
+
+## Hard rule
+
+Do not run `./autogen.sh`, `./configure`, or `make` on the host shell unless
+you have an explicit reason and have verified the host toolchain matches the
+image. CI is the source of truth; CI uses Debian.