docs: add tested CLI, embedding, and WASI walkthroughs

[JairusSW]

Second clean-reader pass

Repeated the public instructions from empty home, Go caches, and project directories. Current public main resolved to 449fe89b56f591de82f36b1094c9789a83239412; beta resolved to v0.1.0-beta.11. No local Wago replacement or previously prepared project was used as fresh-install proof.

Additional fixes found by this pass:

• Six canary-only pages linked to nonexistent beta destinations in the version selector. It now preserves an existing page or falls back to the selected version home; the build checks every rendered internal link and anchor
• Canary provenance and the independent manager / runtime / Go dependency choices are explicit
• Added missing manual PATH setup, source-build tools, compatible TinyGo/Go and Node/npm prerequisites, and tutorial directory continuity
• Public fixture links and the Component Model clone now pin the existing docs commit rather than pointing at files not yet on main
• Corrected Contract use before activation, explicit generic provider typing, and configuration that silently accepted zero
• Added Markdown-extracted authoring regressions and a fresh public-module mode for the embedding checker

Fresh installer, beta/core/standalone, WASI/configuration, typed components, CLI, runtime/profile switching, plugin maintenance (including Wide), profiling, and authoring paths passed. Embedding's eight complete WAT programs passed against both public main and beta.11; AssemblyScript and TinyGo alternatives passed. The fresh public-module regression passed eight programs and seven race-enabled API tests. Authoring's race-enabled snippet regression passed and rejected all three reverted-bug mutations.

Final local npm ci and npm run docs:check: 18 tests, production build, 25 deployment artifacts, 81 pages, and 4,357 internal links/anchors passed. Final tutorial external-link sweep: 35/35 HTTP 200. Independent final review found no blockers. Docs CI passed for exact head b327afa9722076b421931541842206e3b81a4172.

See clean-reader verification and limits for reproducible setup and coverage. Linux watch still requires unavailable procfs child lists; native perf is absent; local browser navigation was blocked. TinyGo used the documented compatible Go pair plus a disclosed sandbox-only VCS-stamping adjustment. No other platform execution is claimed. Recording commands and displayed results are unchanged, so the three previously verified generated GIFs are retained.

Default-version limitation: the site root still opens the frozen beta snapshot. Its old prerequisite/authoring guidance remains unchanged; its first embedding example does currently pass. This PR updates canary source and shared navigation. beta/, .docs-snapshots/, and versions.json remain untouched. The normal release workflow must create a qualified snapshot before the corrected guide text becomes the default release docs.

What changed

Walked through the docs with the actual runtime and kept the guides organized around things a reader can do.

• Added task guides for running/inspecting modules, standalone Go/TinyGo builds, profiling, checked guest memory, WASI commands, and Component Model services
• Fixed broken embedding prerequisites, borrowed-result and callback lifetimes, cancellation examples, instance reuse/shutdown guidance, and artifact trust boundaries
• Made the first plugin actually execute a Wasm guest; corrected the unsupported callback, unnamed scaffold registrar, and catalog-only test gap
• Explained explicit WASI /p1 selection, reviewed mounts/env, config replacement/reset behavior, and the typed Go path for components
• Added repeatable CLI, embedding, and plugin/component fixtures
• Added three real-output GIFs and portable recording tapes; updated navigation, discovery exclusions, and build assertions

These edits target the root canary documentation. The release-owned beta/ tree, immutable snapshots, and versions.json are unchanged. The regular beta snapshot workflow can pick up the new guides when the matching code is qualified.

What ran

Primary runtime baseline: wago b084a7c9, Linux/amd64, Go 1.27.1. Public plugin fixtures pin their actual dependencies; CLI installs tested WASI 0.3.1 and Component Model 0.1.6.

Area	Result
Fresh Unix installer, beta standard/normal selection	Passed; unavailable release assets used the source-build fallback
Config set/get/diff/reset, status, completion preview	Passed in isolated state
CLI validation, metadata/JSON, numeric calls, repeated invokes, traps, native-stack options, artifact trust gate	Passed
Standalone Go 1.27.1 and Go 1.25.0	Passed, including execution without Wago on PATH
TinyGo 0.41.1 + Go 1.25.0	Passed
Embedding	8 programs extracted from the Markdown, 7 race-enabled boundary tests, 16 focused upstream race-enabled tests, and 12 upstream examples passed
Guest language alternatives	WAT, AssemblyScript 0.28.8, and TinyGo 0.41.1 guests passed the corresponding embedding examples
Plugins/WASI	Published P1/P2 install, lock rebuild, config, update/removal, standalone P1, author guest execution, and targeted WASI tests passed
Components	Typed adder, real Rust Preview 2 command, graph/lease/config/cache/revocation tests passed
Profiler	Checked metadata runs, top/annotate/timeline/diff, failure-oracle check, and a real Go CPU capture passed
Site	npm run docs:check passed: unit tests, production build, 25 artifact checks and 81 indexed pages
Runtime tests	Core src/wago suite passed after fetching the pinned Core 3 corpus; 130 test packages passed in the 176-package selection excluding the two watch-dependent packages

See the fixture READMEs under demos/fixtures for rerun commands. The embedding checker reads the actual Markdown programs rather than a duplicate copy.

Limits and findings

• Other OS/architecture combinations were source-reviewed, not executed here
• Full go test ./... hit Linux watch/supervisor tests that require procfs child lists and process controls absent in this sandbox; those two packages are explicitly excluded from the passing selection above
• Native perf was unavailable. Go CPU sampling and native guest-PC attribution are kept distinct in the profiler guide
• TinyGo 0.42.0 + Go 1.25.0 failed with duplicate tinygo_task_exit; a minimal program without Wago reproduces it. The guide gives the verified 0.41.1 path
• The current CLI does not dispatch Component Model binaries. The working Go service route is documented
• plugin config can persist a value that later fails provider startup; config schemas do not enforce every value constraint. The docs now require an actual startup smoke test and provider-side validation
• Go 1.27 Preview 1 os.ReadFile requested rights beyond a read-only mount; the docs explain the diagnosis without recommending broader rights by default
• No registry publication, release, merge, or deployment was performed

GIFs

The existing VHS/humanized-tape path remains the default. Chromium could not start in this execution environment because local sockets are restricted, so the committed recordings use the documented browser-free agg path. It reads the same tapes, executes the visible commands, records actual combined output, and fails if a command fails. No downloads or terminal results are mocked. All three GIFs were rendered and their frames inspected; historical release recordings are unchanged.

The first pass included source/accuracy, link, and diff review. The additional clean-reader findings and fixes are recorded above.