docs(docs): quickstart as a TL;DR and Helm guide as the verified EKS walkthrough

[cubeorgdev]

Fixes #117

Stacked on #116.

Quickstart

Now the short version: the three things you need (the CLI, a config file, a server), what each is for, and a link to the deep page. The governance section leads with what it controls: allowed agents, default model and settings, MCP servers, extensions, session capture. The three "how to deploy" cards from the old page are kept under the server section.

Three things were only in the quickstart, so they moved:

• CLI installation, BLUE_VERSION pinning, and the installer's checksum note are now an Install section at the top of CLI commands.
• The SHA256SUMS check for the deployment bundle is now in the Helm guide.
• The two curl health checks are now under the deployment contract's health-check table.

The two links that pointed at the old #install-the-workstation-cli anchor (Docker Compose page, README) now point at the new Install section.

Kubernetes with Helm

Replaced with the verified end-to-end EKS walkthrough: a bundle download, then fourteen numbered steps from an empty AWS account to a governed agent, with gateway mode as a continuation of the same stack. Prose is one or two lines per step.

Code blocks are the verified ones, with these deliberate changes:

• The reader works from the release bundle's infra/aws folder. The five path exports point at the current directory and at ../../chart/blue instead of a source checkout.
• The revision bump comment and the step 12 sed are gone. The Control API strips revision before comparing the mounted baseline to the stored one (normalized_governance_value), so bumping it did nothing, and Configure blue.yaml already says so. The sed also looked for a value nothing had written.

Content the old page held alone moves to the page that owns the topic:

• cert-manager issuer constraints, the CA cutover warning, and the bring-your-own-certificates Secret layouts: new Internal certificates section on Bring your own gateway. Proxy autoscaling and streaming-ingress notes sit under it as Scaling the proxy.
• Invitation links are only logged until mail is wired: Manage users and invitations.
• blue.config.mountPath caveat: Helm chart README.

Only next is changed; 0.1.0 is untouched.

node scripts/check-content.mjs passes. A code-block diff of the new Helm page against the verified guide shows only the changes listed above. Not run: mint broken-links (not installed here).

🤖 Generated with Claude Code

[cubeorgdev]

This pull request was created from a Blocks session.

View in dashboard | View on desktop

[cubeorgdev]

Superseded by #125, the same two commits rebased onto main.