chore: tidy repository root and publish the docs site

[ticfinack]

chore: tidy repository root and publish the docs site

Three presentation-and-tooling commits. No source or runtime-dependency changes — nothing in agent/, server/, tests/, requirements.txt or uv.lock is touched. The only pyproject.toml edit is an upper bound on the optional docs extra (commit 3); no runtime dependency changes.

1. Repository root cleanup

Untrack build-phase prompt/plan files. edr-agent-implementation-plan.md and phase2/6/7/8-*.md were tracked in the root — roughly 100KB of the planning prompts used during development. phase9-traffic-context-prompt.md was already gitignored, so this finishes what that started. They are removed from version control and covered by .gitignore; nothing in the repo linked to them.

Applying this as a patch rather than merging it: git rm --cached leaves the working-tree copies alone, but applying the resulting patch deletes them locally. Back them up first if you want to keep them.

Move patent paperwork into patent/. PROVISIONAL_PATENT_DRAFT.md/.pdf, USPTO_Specification.md and USPTO_Drawings.html were interleaved with build config in the root (~1MB, the PDF alone is 936KB). All four are pure renames — 100% similarity, no content change.

Root goes from 21 tracked files to 12, all of which belong there:

.dockerignore  .gitignore  LICENSE  README.md  SECURITY.md  config.yaml
docker-compose.yml  edr-graph.spec  mkdocs.yml  pyproject.toml
requirements.txt  uv.lock

Correct two stale README badges. The Python badge understated support: pyproject.toml declares requires-python = ">=3.11" and CI runs the matrix on 3.11, 3.12 and 3.13, so 3.13 became 3.11+. The tests-546 passed badge was refreshed here and then replaced outright in commit 3 — see below.

2. GitHub Pages docs workflow

mkdocs.yml, the Material theme setup and ten pages of documentation were already written but never deployed, so none of it was reachable and the repo had no website link. site_url was already set to https://ticfinack.github.io/edr-graph/, so no config change was needed to make it live.

New .github/workflows/docs.yml:

• build runs on pull requests too, so a broken nav entry or dead internal link fails review instead of shipping. mkdocs build --strict promotes warnings to failures.
• deploy is gated to main and uses the artifact-based Pages flow — no gh-pages branch, and main's history stays clean.
• Default permissions: contents: read; only the deploy job widens to pages: write / id-token: write.
• Action versions match ci.yml and release.yml (checkout@v6, setup-python@v6).
• MkDocs is installed directly rather than through the .[docs] extra, so the docs build does not pull in the full agent runtime. The version constraint is kept in sync with pyproject.toml by comment.

Also adds docs/ENGINEERING_NOTEBOOK.md to the nav — it was being built into the site but sat in no nav section, reachable only by search or direct URL. That was also the last --strict advisory, so the build is now warning-clean.

3. Live CI badges and a MkDocs upper bound

Replace the hardcoded test-count badge with live workflow badges. A tests-NNNN badge cannot be kept correct: the passing count is platform-dependent — this branch measures 1369 passed / 1 skipped on macOS and a different number on Linux CI, since some tests skip on OS capabilities — so any hardcoded figure is wrong somewhere and goes stale as tests are added. Two GitHub Actions status badges replace it, generated from real workflow state and linking to the runs, so the claim is verifiable rather than asserted:

• CI → actions/workflows/ci.yml (lint + the 3.11/3.12/3.13 matrix)
• Docs → actions/workflows/docs.yml, linked to the published site

Bound mkdocs-material below 10. Both the docs extra and the docs workflow requested >=9.5.0 with no upper bound. Material currently emits a build-time warning that MkDocs 2.0 removes the plugin system and rewrites theming with no migration path, so an unbounded floor means a future major release could break the docs build with no change on our side. Now >=9.5.0,<10 in both places.

Verification

• mkdocs build --strict — exit 0, warning-clean
• .github/workflows/docs.yml — parses as valid YAML
• Grepped for references to the moved patent files across *.md, *.py, *.yml, *.html — none outside patent/ itself
• Confirmed the untracked prompt files are matched by the new .gitignore entries (clean git status with all five still on disk)
• Both badge targets exist (.github/workflows/ci.yml, .github/workflows/docs.yml), so neither badge renders as "no status"
• pyproject.toml parses and the bounded docs extra resolves against the installed mkdocs-material 9.7.3
• pytest tests/ — 1369 passed, 1 skipped (unchanged; no source or test files are touched by this PR)

Note before merging

GitHub Pages is already configured with "GitHub Actions" as its source, and the repository website field is linked to the Pages URL, so the deploy job will run on merge with no further setup.

Note that deploy is skipped on pull requests by design, so the deploy path itself stays unexercised until this lands on main. Everything up to and including the artifact upload is covered by the Build site check.