docs: reorganize navigation for feature discoverability (#1147)

Restructures the Documentation tab so each group answers one operator
question.

- Split the 12-page "Stacks & Deployments" into Stacks (per-stack work)
  and Deployment (the act of deploying); promote Resources Hub to a
  standalone item.
- Dissolve the 2-page "Platform" junk drawer: Sidebar moves to Stacks,
  Host Console moves to Fleet.
- Rename "Fleet & Multi-Node" to "Fleet"; absorb Node Compatibility
  from Reference. Move Scheduled Operations from Fleet to Automation
  (now a 4-page group covering Scheduled Ops, Auto-Update, Auto-Heal,
  Webhooks).
- Clean up the Reference tab: drop misplaced node-compatibility, move
  root-level security.mdx into reference/, delete the orphan
  reference/verifying-images.mdx after porting its Available Tags
  table into operations/verifying-images.mdx.
- Reorder top-level groups: Operations moves above Reference.
- Rename two misleading page titles: "Deploy Progress Modal" becomes
  "Deploy Progress" (drops the UI implementation leak); "Auto-Update
  Readiness" becomes "Auto-Update Policies" (matches filename and
  sibling "Auto-Heal Policies").

Verified: docs.json parses as valid JSON, 59 disk .mdx files match
59 nav entries with zero orphans and zero broken refs.

docs/operations/verifying-images.mdx

@@ -111,3 +111,15 @@ A clean result means no unresolved HIGH or CRITICAL CVEs. CVEs listed as `not_af
 <Note>
 Trivy 0.36.0 or later is required for `--vex` flag support.
 </Note>
+
+## Available tags
+
+Each release publishes two moving tags plus one immutable tag, so you can choose how aggressively you want to track updates:
+
+| Tag | Example | Updates on |
+|---|---|---|
+| `latest` | `saelix/sencho:latest` | Every release |
+| `X.Y` | `saelix/sencho:0.42` | Every patch release in the `0.42.x` line |
+| `X.Y.Z` | `saelix/sencho:0.42.7` | Never (immutable) |
+
+For production, pin to `X.Y.Z` or `X.Y` and verify the signature on every pull. For staging or development, `latest` is fine.