docs: Document the deployment

Add a top-level README mapping the boxes and a full docs/ tree: topic
pages (architecture, networking, deployment), per-site box pages for
colony and home with containers nested under their hosts, remote and
mobile boxes, the installer, and the home switch fabric reference
(folded in from home-switches.md, with AGENTS.md and code comments
retargeted to its new home). Box pages carry marked assignment tables
that CI regenerates from nixos.allAssignments.

AGENTS.md points at the new docs and keeps its terse agent version of
the mechanics, referring to the topic pages for depth.

docs/misc/installer.md

@@ -0,0 +1,42 @@
+# installer
+
+The custom NixOS installer image used to bootstrap new boxes.
+
+- **Source:** [`nixos/installer.nix`](../../nixos/installer.nix)
+- **Host:** — (a build target, not a deployed box)
+
+## Role
+
+- Defines `nixos.systems.installer`, a minimal server system rendered as a bootable ISO via
+  `config.my.buildAs.iso` (`my.asISO`); the same base can also be built as a kexec or netboot
+  tree.
+- Build it with the devshell commands: `build-iso installer` (or `build-kexec installer` /
+  `build-netboot installer`). The `update-installer` command force-tags `installer` to
+  trigger a release rebuild in CI.
+
+## Image contents
+
+- Broad hardware support (`my.build.allHardware` pulls in the nixpkgs all-hardware profile);
+  EFI- and USB-bootable, zstd-compressed squashfs. Volume ID
+  `jackos-<release>-<arch>`, menu label "/dev/player0 Installer", image base name
+  `jackos-installer`.
+- Root SSH with the deploy key authorized (`PermitRootLogin prohibit-password`); a random
+  `installer-<hex>` hostname is set at boot.
+- `INSTALL_ROOT=/mnt` in the session environment, plus a `show-hw-config` alias wrapping
+  `nixos-generate-config --show-hardware-config --root $INSTALL_ROOT`.
+- NixOS documentation enabled, `wpa_supplicant` available but not started, aggressive GC
+  (`GC_INITIAL_HEAP_SIZE=1M`) and `vm.overcommit_memory=1` for low-memory targets, LVM thin
+  and NFS support.
+- No regular user (`my.user.enable = false`), no tmpfs-root management, no NAT, and not a
+  deploy target (`my.deploy.enable = false`).
+
+## Installing a box
+
+The devshell's installer commands ([`devshell/install.nix`](../../devshell/install.nix)) drive
+an install over SSH against a booted installer reachable at `$INSTALLER`:
+
+- `installer-shell` — get a shell on the installer.
+- `do-install <system>` — builds the system's toplevel, `nix copy`s the closure to the
+  installer's `$INSTALL_ROOT` remote store, sets the system profile, touches `/etc/NIXOS`,
+  and runs `switch-to-configuration boot` with `NIXOS_INSTALL_BOOTLOADER=1` (skip the
+  bootloader with `--no-bootloader`, skip substitution with `--no-substitute`).