docs: align Flow claims with current contracts

[abrichr]

PR #401 moved Flow's lifecycle to admission-derived product state. PR #404 wired the appliance tiers for resume, and PR #408 made the egress posture sticky before execution. Eight useful pieces from #381 still needed a current branch.

Flow's opening now names it as OpenAdapt's demonstration compiler and governed runtime. The safety text records uncertain delivery as RECONCILIATION_REQUIRED with no blind retry. The claims registry keeps required-CI evidence tiers separate from release and workflow admissions.

The geometry text stays inside the evidence. Browser attach can start an exact epoch after a stable viewport change; native conversion needs valid mapping metadata and a fixed output viewport, while RDP and Citrix can rebaseline only between actions.

Capture ownership now points to openadapt-capture, while the remaining edits state the identity and operator-authentication requirements, describe current VLM wiring across replay, resume, and attended execution, and refresh the generated claim artifacts. This PR doesn't change release state or publish a package.

Checks:

• python scripts/check_consistency.py
• python scripts/validate_claims.py --check --structure-only
• python scripts/check_release_consistency.py
• 160 focused docs, claims, Capture adapter, VLM, drift, and backend-capability tests
• git diff --check