docs(deployment): add Zero-Trust edge gateway deployment architecture (#103)

[showmemercy19-rgb]

Adds zero-trust edge gateway deployment guide.

[github-actions]

All applicable PR CI workflows passed for 7ed5a97.

• ci
• security

Ready for maintainer code review.

[armstrongsam25]

Thanks for contributing. I reviewed the full diff against current main and the LETS constitution.

"Stateless ephemeral token verification" is misleading for this deployment: docs/operations.md requires durable peer nonce replay authority and independent production authority anchors; src/lets/executor.py uses a durable receipt claim store. The entire architecture is only two bullets. Please supply the actual gateway/warden/executor trust-boundary architecture and deployment/configuration steps, including durable anti-replay and fail-closed admission, and identify which TLS/mTLS controls are operator configuration versus enforced defaults.

Please expand this into complete, source-backed documentation before merge (constitution XI and XII). This head contains no measurable executable lines, so changed-line coverage is not applicable; that should be recorded explicitly in the PR. No tests or candidate code were executed during this review.

[armstrongsam25]

Closing after source-based triage of head 7ed5a97. The architecture submission consists only of mTLS and stateless-verification bullets. Stateless verification is misleading for the actual executor, which verifies and durably claims receipts, and the document supplies no gateway architecture, configuration or admission procedure. Existing operations documentation already specifies the real durable production boundary.

Evidence: durable executor claim; operations boundary; entire submitted architecture.

Triage criterion: unsupported-completion. Closing this unmerged PR does not close an unfulfilled task, delete the contributor branch, or award bounty points. A distinct substantive revision may be reviewed after reopening.