docs: tokens in a file, no keyring (U0e)

Deploy recipe loses its D-Bus dance, install.sh its macOS skip, README and
site their macOS caveat; packaging, architecture and testing records follow;
U0e As built filled in (D-63).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

README.md

@@ -67,11 +67,9 @@ Sheet is frozen as of 2026-10-11. The remaining work, its order and its
 hand-off are `plan/served.md` section 8.0; the destination is one
 installed app for Mac, Windows and Linux (P11), then the hosted service
 the plan describes and does not build. Today the agent path runs on
-Linux: tokens live in the OS keyring (the Secret Service on Linux, the
-login Keychain on macOS, the Credential Manager on Windows; the last two
-are written and compiled by the CI matrix, P11a step 0, and not yet
-proven on a machine of ours); the rest of the host is Unix-only, so
-Windows is WSL2 only until its sockets and data root are ported.
+Linux and macOS: tokens live in a 0600 file under the private data root
+(D-63); the rest of the host is Unix-only, so Windows is WSL2 only until
+its sockets and data root are ported.
 
 See [`plan/STATUS.md`](plan/STATUS.md) for where things stand and
 [`plan/roadmap.md`](plan/roadmap.md) for where it's going.
@@ -90,10 +88,7 @@ them; nothing needs sudo):
 curl -fsSL https://wanderbooks.ai/install.sh | sh -s -- acme
 ```
 
-(Linux today. On macOS the same line installs and sets up, and the
-viewer runs; connecting an agent uses the login Keychain, new with
-P11a step 0 and proven only by the CI matrix so far. On Windows run it
-inside WSL2.)
+(Linux and macOS. On Windows run it inside WSL2.)
 
 Already installed, three commands: `wanderbooks setup`, `wanderbooks books
 create acme`, `wanderbooks connect claude --book acme` (or `connect codex`).