docs(reference): add CLI command reference and config/spec pages - #863

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/reference/cli-min.md`:
- Around line 8-11: Update the introductory description of the min CLI to state
that most commands automatically start minimald when it is not running, while
explicitly identifying the bug command as an exception. Keep the existing daemon
and session-management context unchanged.
- Line 30: Add language identifiers to every fenced code example in
docs/reference/cli-min.md, including the listed locations, using the appropriate
identifier such as console or shell so all fences satisfy markdownlint MD040.
- Around line 131-136: Update the environment-variable redaction behavior
described in the CLI documentation so sensitive-shaped names always take
precedence over the verbatim allowlist, including MINIMAL_*, MINVMD_*, and
MINIMALD_* variables. Restrict those prefixes to explicitly known-safe names or
state that sensitive-name filtering is applied after allowlist matching,
ensuring values such as MINIMAL_API_TOKEN are recorded by name only.

In `@docs/reference/cli-minimald.md`:
- Line 29: Add the console or shell language identifier to both fenced command
blocks in the CLI documentation, including the fences at the referenced
locations, so they comply with markdownlint MD040.
- Around line 21-22: Update the defaults documented for the --minimal-state-dir
and --minimal-cache-dir options to reference XDG_STATE_HOME and XDG_CACHE_HOME
respectively, keeping the existing option descriptions unchanged.

In `@docs/reference/cli-minvmd.md`:
- Line 26: Add a language identifier to every fenced command block in the CLI
documentation, including the blocks at all referenced locations. Use console or
shell consistently so markdownlint-cli2 MD040 passes.

In `@docs/reference/cli-mip.md`:
- Line 34: Add a console or shell language identifier to every fenced command
block in cli-mip.md, including the listed occurrences, while leaving the command
content unchanged.

In `@docs/reference/cli.md`:
- Around line 41-45: Update the “In-sandbox helper commands” overview in cli.md
to include build, test, and patched-pkg alongside add, search, check, and run,
or revise the wording to clearly indicate the listed commands are only examples;
keep the link to sandbox operations intact.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/reference/linux-host-setup.md`:
- Around line 105-111: Update the “User namespaces disabled entirely” section to
include kernel.unprivileged_userns_clone as an additional check and remediation,
covering hosts where it is set to 0 alongside CONFIG_USER_NS and
user.max_user_namespaces. If the troubleshooting guidance cannot support this
case, explicitly narrow the section’s scope to the two existing failure modes.

In `@docs/reference/loadouts.md`:
- Around line 24-26: Add an explicit language identifier to both fenced code
blocks in the loadouts documentation: use text for the path example and text or
console for the loadout-list output. Keep the existing fenced content unchanged.

In `@docs/reference/minimal-dot-toml.md`:
- Line 75: Update the sideload documentation example and heading to use
[[upstream.sideloads]] as the primary syntax, and identify [[upstream.sideload]]
only as the accepted compatibility alias.
- Line 3: Update the front-matter description for the minimal.toml reference so
it reflects all documented schema sections, including session, params, cache,
and stdlib, while retaining the existing sections or replacing the list with
accurate broader wording.
- Around line 96-101: Update the primary stack example to use the canonical
`name = "<stack name>"` key instead of `use`. Retain `use` only in the
surrounding documentation as a deprecated compatibility alias, consistent with
the `[stack]` guidance.

---

Outside diff comments:
In `@docs/reference/linux-host-setup.md`:
- Around line 64-72: Revise the AppArmor profile explanation in the section
describing `flags=(unconfined)` to remove the claim that installing it does not
weaken the host. State that the profile leaves `minimald` unconfined and grants
it `userns`, expanding permissions for that application while not changing
host-wide settings or affecting unrelated binaries.

In `@docs/reference/minimal-dot-toml.md`:
- Around line 212-214: Update the raw-file validation rule in the documentation
to explicitly list both vars and its env_vars alias as invalid oci-image-only
fields, while preserving the existing entrypoint, cmd, and path restrictions.