docs: align docs with shipped behavior (audit fixes)

[leet-c1]

A full audit of every tracked .md file against the current command/help surface and recent PRs (#103–#117) found places where a shipped change hadn't reached one or more docs. No behavioral defects and no branding/identifier leaks were found — these are documentation-only fixes. Six Sonnet agents did the audit; a Sonnet reviewer verified every fix against --help/source.

HIGH — a shipped change a doc missed

• cmd/agents.md — the v0.6.0 BREAKING envelope-unwrap was never in the agent-facing "Reading output" section. Added: typed get prints the resource flat (.id, not .app.id), naming a wrapper key in --fields exits 2, and mcp servers get has only connectorId.
• README.md — added the docs search no-relevance-threshold caveat (docs: state that docs search has no true no-match #117), which had reached --help + docs agents but not README.
• CHANGELOG.md — [Unreleased] had duplicated ### Added/### Changed headers (the merge-duplication pattern); merged to one Added/Changed/Fixed each. All 14 entries preserved verbatim.

MED

• README: policies step_kinds/baseline_policy_id + the auto-approval jq recipe (feat: identify the auto-approval grant policy portably, via step_kinds #103); mcp servers register --user-id and the flags settable at register time.
• agents.md: mcp tools approve takes multiple ids in one process (feat(mcp): approve multiple tools in one invocation #116).
• CLAUDE.md: the shared repeatable-flag registrar convention (fix: one registrar for every repeatable flag; reject an empty occurrence #111).

LOW

• README: --tool-id caps (100/32), requestable-connectors non-pagination, entitlements create --resource-type default CUSTOM, requests create --duration Go-style vs the protobuf-duration flags.
• agents.md + skill: malformed---url rejection (fix: reject malformed --url, correct TTY detection, document mixed-case re-login #115).
• CLAUDE.md: negative --limit/--page-size rejection + page-size clamp.
• .claude/commands/c1i.md: auth token, the ~/.c1i.yaml wrong-tenant stderr warning, a command-groups pointer, the docs-search caveat.

Validation

Every claim verified against --help or live behavior (e.g. mcp servers get confirmed to have no id); embedded docs agents re-checked to render the new content. Build, vet, test, -shuffle=on, golangci-lint (0), gosec (0), gitleaks (clean), govulncheck (clean) — and TestReadmeCommandsResolveAgainstCobraTree (138 c1i invocations resolve). Independent Sonnet review found nothing to flag.

🤖 Generated with Claude Code