docs(computer-use): document package boundaries

[yuzhiyang1]

Summary

Add a package-local README for @maka/computer-use and link it from the documentation authority map. It documents the package boundary, public exports, current macOS and maka-cu selection constraints, fail-closed behavior, protocol and lifecycle ownership, verification commands, and tracked cross-platform work.

All statements are grounded in the current source; this does not add setup or distribution promises.

Fixes #4004

Verification

• Markdown relative-link scan: passed.
• npm run lint
• npm run format:check
• npm run build
• npm run typecheck
• npx knip --workspace apps/desktop
• npx knip --workspace packages/ui
• npm run check:asf-headers
• npm --workspace @maka/computer-use test was attempted on Windows: 50 passed and 68 failed with spawn EFTYPE in the existing executable fixtures. This PR changes Markdown only; package source and tests are unchanged.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with repository analysis, documentation drafting, verification, and PR drafting. The human contributor reviewed the change and remains responsible for it.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

Almost ready - one statement doesn't match the code, and for a documentation PR that is the only thing that can be wrong, so I'd like it fixed before approving.

packages/computer-use/README.md, "Current platform boundary", condition 2. The README says the selector enables Computer Use only when "the composition supplies an absolute maka-cu executable path". selectComputerUseBackend (select-backend.ts) checks process.platform !== 'darwin', then !deps?.binaryPath || !deps.expectedBinarySha256, then falls to NONE on any construction throw - it never checks absoluteness, and isAbsolute does not appear anywhere in packages/computer-use/src. A relative path passes selection and is resolved against the process cwd. The consequence is bounded because the SHA-256 digest still gates the bytes, but the sentence promises a guard that isn't there, and whoever wires a composition is exactly the reader who would rely on it. Either drop "absolute", or add the check to the selector so the sentence becomes true.

Everything else checks out against source, which I verified rather than read past:

• src/index.ts really is the single root entry (package.json exports is the bare "./dist/index.js"), and each named export exists.
• CU_BACKEND_IDS is ['maka-cu'].
• The three fail-closed paths to backendId: 'none' match the code exactly.
• MakaCuLifecycleError, MakaCuRpcError and MakaCuProtocolViolation all exist, in the files implied.
• All three linked documents exist, and the docs/README.md entry sits in the package-README group where it belongs.
• The claimed test coverage maps one-to-one onto the seven files in src/__tests__/ - protocol, service lifecycle, backend, host events, display snapshot, overlay hook, cumulative e2e - rather than being a generic claim.

The Windows spawn EFTYPE failures you noted are pre-existing fixture behavior and unrelated: this PR touches Markdown only.

AI-assisted review disclosure: Claude Code cross-checked each README statement against the package source; I verified the selector gate, the export surface, and the test-coverage mapping against current main myself.

[yuzhiyang1]

Addressed in commit 184a5a8. The README now says the composition supplies a maka-cu executable path, matching the selector's actual contract; it no longer claims an absolute-path guard that the package does not implement. I kept the follow-up documentation-only rather than adding a new production constraint.

Re-ran npm run format:check, npm run lint, npm run build, npm run typecheck, both Knip checks, the ASF header audit, the Markdown relative-link scan, and git diff --check; all pass.

Automated response from OpenAI Codex at @yuzhiyang1's direction.