docs: specify DevGuard adoption gates and link detailed plans

[novelKR]

Summary

The roadmap did not yet explain the minimum conditions for consuming DevGuard or the concrete registration, execution, and recovery boundaries. The English and Korean guides now describe adoption levels, single Runner registration, private credential-FD transfer, preparation and approval handling, uncertain execution, bounded control paths, and Gateway recovery while an independent Runner remains alive.

The canonical work packages are in DevGuard documentation PR #1, linked through an immutable planning index. Its milestone documents own the 46 proposed commit units, 23 logical PR groups, tests, completion evidence, and rollback procedures.

Scope and references

• CodeSpace runtime baseline: e94d21475643608ad2a466256fb57266b86faa47.
• This PR includes the previously unpublished roadmap commit fb822fc24c98f6628dce62d33a5cc67275f8ca34 and the new CSP-D01/CSP-D02 documentation commits.
• CodeSpace documentation head: c8728d761addccdeb7a547a02c3319f800c0df0a.
• DevGuard documentation revision: f3e6827f5dca2184c9b100ed9a3438af7322ba64. No runtime DevGuard client pin has been selected.
• Codex remains pinned to 6b9826e3aa83b1a5947db50f4332cb9c65f1b340. Runtime code, Cargo dependencies, Runner wire, and workflows are unchanged.
• Only the paired guides and their translation-registry entry change. Work used an isolated checkout; the original checkout's staged .codex/config.toml is preserved.

Validation

• Reviewed English/Korean equivalence and recorded only devguard-integration; all 17 documentation pairs pass the registry check.
• Node 24.21.0, npm 11.19.0, and the existing lockfile: all 5 documentation tests, the site build, and integrity checks passed (37 HTML pages, 155 hashed files).
• Confirmed that the immutable DevGuard document revision exists on the remote.
• Hosted documentation CI passed. The Pages deployment job is intentionally skipped for pull requests.
• Existing full CI passed all 15 jobs, including integration, Linux isolation, macOS contracts, and the aggregate Rust gate. No checks were waived and no workflow filters were changed.
• Local browser smoke checks covered both languages, light/dark themes, desktop/narrow layouts, language navigation, search, and copied Markdown containing the fixed planning revision.

DevGuard DG-0 remains a fake-backend contract foundation. Runtime integration, real OS protection, self-use, and SLO qualification are future milestones. Existing execution-mode shutdown behavior is unchanged. Review the DevGuard documentation PR first; these immutable links work before it merges. Merge and runtime implementation are separate steps.

This PR is ready for review. All validation above is associated with the current documentation head; no post-merge main run or DevGuard runtime qualification is claimed.