docs: refresh architecture references and add OAuth/request-graph analysis notes

Documentation catch-up after the plugin split across multiple earlier
commits, plus two new analysis write-ups from the live Proxyman
capture sessions.

Path corrections
- AGENTS.md: points beta composition logic at src/betas.ts +
  src/headers/builder.ts, and points mimicry regression tests at
  index.test.ts + tests/regression/fingerprint/cc-comparison.test.ts.
- CONTRIBUTING.md: renames dist artifact to .mjs, updates Mermaid
  diagrams to reference src/index.ts and src/cli.ts instead of the
  retired index.mjs / cli.mjs, and fixes the test-coverage table.
- README.md: small clarifications, no behavior changes documented.
- docs/fingerprint-ingestion.md, docs/opencode-plugin-cache.md,
  docs/verification-runbook.md: keep in sync with the new capture
  pipeline (proxyman/* scripts, --og-capture / --plugin-capture, etc.).

New
- docs/claude-code-oauth-status-flow.md (98 LOC): traces the OAuth
  /status endpoint the plugin now polls, including the 5 states and
  the rotation hook points.
- docs/claude-code-request-graph.md (285 LOC): analytical write-up
  of the observed vs sent request shape, including the
  sk-ant-api03/sk-ant-oat01 token class distinction and a negative
  finding that no persistent API key lives in the ordinary config
  paths.
- manifests/reports/diffs/2026-04-15-cc-vs-plugin-request-diff.md,
  manifests/reports/diffs/2026-04-15-proxyman-cc-vs-plugin.md:
  human-authored diff reports from the verification run that fed
  this batch of changes.

.gitignore gains manifests/reports/proxyman/ and
manifests/reports/verification/ to keep live HAR captures (which
contain raw OAuth access tokens) out of git by default.