Align the two hosts' extension surfaces and correct the docs

The survey of what a user touches when configuring their own resources,
CLIs, policies and runtimes found no missing plane, only reachability
gaps, py/ts asymmetries and silent traps. This closes the verified ones.

Resources
- The Python loader restores a custom resource from a snapshot the way
  TypeScript does: `resolve_entry(type)`, then the recorded
  `resource_ref`, then the class import, refusing the anonymous module a
  `./x.py:Cls` ref used to be recorded as. `needs_override` is honored
  in Python; the config class is the entry's or `CONFIG_CLS`, with no
  suffix scan. Both snapshots record `MountKey.RESOURCE_REF`.
- `workspace load/clone <tar> <yaml>` rebases a relative code ref onto
  the yaml's directory in both CLIs, as `create` already did, and an
  override that cannot be built is a 400, not a 500.

Policies and CLIs
- A sync hook no longer turns into a Deny on every command:
  `Policies._fire` awaits only what is awaitable, and a CLI leaf runs
  through `call_leaf`, so a sync leaf and a sync throw behave as they
  do in TypeScript.

Runtimes
- Python gains `register_runtime`/`known_runtimes`; TypeScript's
  `registerRuntime` refuses the builtin names and `knownRuntimes()`
  lists them.
- A `runtimes:` entry may name a `Runtime` subclass by code reference
  (`./box.py:EchoBox`, `./box.mjs:EchoBox`, `pkg.mod:Cls`), the form
  `resource:` and `cli:` take, as a mapping with options or as a bare
  string. Both loaders rebase it against the config file and refuse a
  non-Runtime with one wording. `integ/runtime_ref.sh` pins a
  line-executor and an interpreter runtime loaded this way on py, mjs
  and ts.

Packages and barrels
- node and browser build per-module with tsc and export `./*`, so the
  authoring types core defines are reachable from an installed package.
- The Python root exports the authoring surface, with `mirage.sdk`
  folded in and removed; `mirage.policy` and the TS core barrel export
  `Outcome`; the core barrel exports `enoent`/`enotdir`/`eisdir`.
- `ws.fs` is the facade in both languages.

FileType
- TypeScript now matches Python: `FileType` is the POSIX kind,
  `ContentType` the rendering hint, `FileStat.type` is required and
  `FileStat.content` is validated as file-only. One helper vocabulary in
  `utils/filetype` on both sides (`content_type_for_path`,
  `content_type_for_extension`, `content_type_for_mime`,
  `mime_type_for`). The github stat's private extension guess, which
  defaulted to text where the shared helper defaults to binary, is
  gone. `ContentType` values and the wire MIME table are unchanged.

Docs
- Corrections only: the observer import, the FUSE session wording, the
  snapshot imports, the browser limitations row, and `SIZES_ALWAYS_KNOWN`
  warning rather than refusing. The 17 orphan `docs/python/setup/*`
  pages were stale duplicates of the in-nav resource pages and are
  deleted, with every link into them repointed.

Integ
- `integ/resource_ref.sh` and `integ/runtime_ref.sh` batteries with
  their fixtures, `integ/runtime/registry.json`, sync-policy twins in
  `integ/runtime/policy.json`, and the feed half of
  `integ/truth/custom_resource.json`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>