docs: notes layering + goal reduced to confinement principle

capsite-notes: What-we-built gains the webapp/diigo-dump layers (links
to READMEs and the goal tree, not repeats); root Goal restated as
'confine the diigo secret to a small auditable piece behind an
attenuated interface' per discussion, with the dead API-key path noted
and details delegated to the tree; credentials section de-staled
(placeholder values, unconditional 401 finding, cookie-path direction);
private-bookmarks note no longer recommends the dead HTTP Basic path.
diigo-bookmarks/README: title corrected sandboxed->native with the
conversion note and a disclaimer that its Develop/Publish sections are
inherited scaffold text (larger rework deferred).

Generated-by: opencode (GLM)

diigo-bookmarks/README.md

@@ -0,0 +1,49 @@
+# diigo-bookmarks
+
+A **native** plugin for [EmDash CMS](https://emdashcms.com) (converted from
+the sandboxed scaffold; wired via the `plugins: []` descriptor list in the
+site's astro.config — see [the capsite notes](../capsite-notes.md)).
+
+Note: this README's Develop/Publish sections below are inherited from the
+sandboxed scaffold and do not match the native wiring.
+
+## Develop
+
+```sh
+pnpm install
+pnpm run validate
+pnpm run typecheck
+pnpm run test
+pnpm run build
+```
+
+To test against a running EmDash site, run `pnpm run dev` in this
+directory (rebuilds on save) and `pnpm add file:../path/to/this`
+in the site. Then `import diigoBookmarks from "diigo-bookmarks"` and pass
+it into `emdash({ sandboxed: [diigoBookmarks] })`.
+
+`pnpm run test` builds the plugin and runs its tests through Worker Loader using
+EmDash's production sandbox wrapper and host bridge.
+
+## Publish
+
+```sh
+pnpm run login -- alice.example.com
+pnpm run publish          # builds and uploads artifacts to your PDS
+```
+
+To publish from GitHub Actions, run `pnpm run release:setup`. The command
+creates one shared workflow at the Git repository root.
+
+## Version bumps
+
+Bump `version` in `package.json` when you ship a release. The
+scaffold's `emdash-plugin.jsonc` deliberately omits `version` —
+the build pipeline reads it from `package.json` so there's a single
+source of truth. **Bump major** for breaking changes, **bump minor**
+for new routes or hooks, **bump patch** for fixes.
+
+You MUST bump version whenever you change `capabilities`, `allowedHosts`,
+or `storage` in the manifest. Installed users have consented to the
+old trust contract; a change without a version bump would let new
+behaviour slip past consent.