docs: align Apple Silicon image, macOS integration, and kernel roadmap

[scottjones]

Summary

• Refresh the image design into an overview of implemented standalone behavior, the macOS integration contract, and remaining release gates.
• Add the consolidated Marcelo integration plan: mandatory Linux-side encryption, a boot-bound prepared target, temporary installer retention, and bounded resumable reclamation.
• Add the managed-kernel plan and dated input audit, including the historical M3 Image/module config mismatch and the requirement for a fresh coherent build.
• Record installer Harden Apple Silicon provisioning and shared-ESP reinstalls #19, desktop #372 (including review-fix revision 39629f3f65db671c7d866b4d94d8b9b092037e3a), and merged ARM package Own System ESP GRUB after UEFI-only #12 as explicit companion baselines.
• Link the plans from README and retain the earlier image design through an immutable historical reference.

Scope and coordination

Documentation only, based on main at 665adb942e41f78f282193799047f03dfbb23ff0; no installer code or other PR commits are included. PR-branch hardware evidence is explicitly distinguished from merged functionality. The September 7 standalone M3 test does not qualify the new macOS integration or managed-kernel updates.

Related work:

• Harden Apple Silicon provisioning and shared-ESP reinstalls #19
• Harden Apple Silicon first login and snapshot setup omacom/omarchy-mac#372
• Carry Snapper and first-run service fixes in ARM package builds omarchy-pkgs-aarch64#12

The original installer checkout and the separate integration workstream are untouched. Updating the documented desktop baseline does not update another worktree's dependency lock or built packages. Marcelo's agreement to bounded Linux-side GPT changes and safe kernel update/fallback qualification remain release gates, not prerequisites to isolated source development.

Validation

• ./test/unit: pass on the isolated documentation branch; ShellCheck unavailable/skipped.
• Local Markdown paths and referenced heading anchors: 21 checked, all pass.
• git diff --check: pass.
• Changed-file scope: README and Markdown files under plans/docs only.

No image/kernel build, workflow publication, disk operation, firmware change, or new hardware test was performed for this PR.