docs: first-principles refresh — encoding reality, architecture, overhead verdict, hardening backlog

[sepahead]

Summary

Comprehensive, accuracy-correcting documentation pass (docs only — no protocol/library/code changes). Grounded in this session's measurements + a 20-lens review + a 35-finding audit.

Corrections

• Encoding reality: clarifies that protobuf is the schema/IDL + conformance contract, not the shipped runtime wire. The runtime wire is JSON (serde_json) on Sensor/Command/RPC + a binary BulkBlock for bulk observations; the prost gen/rust bindings are generated artifacts, not compiled into the SDK. (Fixes the prior "JSON/protobuf is the wire" overstatement across README/RATIONALE/proto/gen.)

Additions

• Architecture (first-principles): NCP is generic; Engram/Paper2Brain = hub/command-center (NEST backend); crebain = dual-mode (own onboard stack and/or NCP); prisoma = observer. Same wire, different roles.
• Overhead verdict (PERFORMANCE.md): measured table + an explicit "Is NCP unnecessary overhead?" answer (no — full tick ~1 µs ≈ 0.003–0.1% of a 20–1000 Hz budget; Zenoh chosen for features not latency); plus the top safe optimization (ncp-zenoh payload.to_vec() → SHM zero-copy).
• New examples/benches documented; KNOWN_LIMITATIONS cross-referenced.

New file

• KNOWN_LIMITATIONS.md — 35 audited findings (3 high: bulk.rs decode OOM-DoS; fail-OPEN unbounded/+Inf ttl_ms watchdog; empty-position geofence bypass), each marked safe vs wire-breaking. Proposals only — none applied.

Note: NCP main CI is pre-existing-red (fmt/cargo-deny/ts-dist); this PR changes only docs.