Document canonical run_id, legacy endpoint policy, and ALLOWED_ORIGINS env var

Made-with: Cursor