docs(peer): document authenticated sharing architecture

Update user and developer documentation for the protocol-8 system: persistent
SPKI-derived identities, exact catalog ContentId authority, pinned responder
pulls, structured runtime ownership, direct-author Call to Play, and the global
local-network sharing switch.

Remove active descriptions of repository-wide certificates, pushed deltas,
relayed histories, and metadata consensus. Keep operational and UI boundaries
aligned with the implementation, including the fail-closed production catalog
gate.

Test Plan:
- `just fmt` (passed)
- `git diff --cached --check` (passed)

design/launcher/SPEC.md

@@ -1,5 +1,8 @@
 # Handoff: SoftLAN Launcher redesign
 
+<!-- Exact layout diagrams and CSS literals intentionally remain unwrapped. -->
+<!-- rumdl-disable MD013 -->
+
 A modern, gamer-friendly redesign of the SoftLAN local-network game launcher,
 replacing the current basic UI with a Steam-inspired dark layout that keeps high
 usability while adding cover art, state-coded actions, a game-detail overlay,
@@ -945,20 +948,24 @@ also seeds a few representative calls on mount (a live call with chat, a fresh
 call you started, a scheduled call whose check-in window just opened, and one
 scheduled for later collecting RSVPs).
 
-The production launcher uses the peer's existing QUIC control channel. Each
-create, response, RSVP, chat, leave, cancel, start, or deadline-extension action
-is an immutable, uniquely identified event. Connected peers receive new events
-immediately, while `Hello` / `HelloAck` exchange the bounded, deduplicated event
-history so a late joiner reconstructs every event and chat message for active
-calls. Running and Cancelled calls retain their complete history for 15 minutes
-so late joiners can see the outcome, roster, and chat, then compact to a Start
-or Cancel tombstone for the rest of the peer session. Unresolved calls are
-removed after the five-minute post-deadline recovery period. The frontend
-reducer turns that event history into the `Nomination` state above, derives
-time-based phase changes locally, and prunes retired raw events. Stable peer IDs
-identify actors and enforce creator controls; `settings.username` is only the
-display name. These deadlines use event wall-clock timestamps, so LAN clocks are
-assumed to be reasonably close; no clock-synchronization protocol is attempted.
+The production launcher sends only local intents over the app boundary. The peer
+core generates each immutable event's call/event nonces and timestamp, then
+publishes a bounded revision-change hint to connected peers. A hint is only a
+liveness optimization: receivers perform an authenticated, identity-pinned
+`Hello` pull and replace that author's complete bounded slice. Peers do not
+relay another author's history, so a late joiner must discover, pin, and pull
+every live author before its wholesale view contains the union of creator,
+participant, and chat events.
+
+Running and Cancelled calls retain their complete author-owned events for 15
+minutes so late joiners can see the outcome, roster, and chat, then expire from
+the view. Unresolved calls are removed after the five-minute post-deadline
+recovery period. The frontend reducer derives the `Nomination` state and
+time-based phase changes from each full replacement. Stable peer IDs identify
+authors and enforce creator controls; `settings.username` is a bounded display
+name that can update an author's snapshot without creating an event. These
+deadlines use event wall-clock timestamps, so LAN clocks are assumed to be
+reasonably close; no clock-synchronization protocol is attempted.
 
 ---