docs(cli-registry): name the real tests and fields the catalogue docs point at

Three instructions a future contributor would follow literally were stale after
the last review round: the "Adding a CLI" checklist sent the agent-image reason to
AGENT_IMAGE_SPECIAL_CASES, a constant that no longer exists (it is
discovery.install.agentImageLayer on the entry in stock.ts), the trust-boundary
paragraph credited the embedded-commands pin to the invariants test when it is
test/cli-catalog-sync.test.ts, and install.sh claimed "the parity test" pinned the
DeepSeek Harness banner when no test did. That pin now exists: the invariants test
asserts the script's grep literal and the registry's discovery.identity.regex agree
on "DeepSeek Harness", and the comment names it.

docs/docker-cases.md separated the two reasons a CLI stays out of the shared npm
layer (no npmPackage at all versus an agentImageLayer entry), which it had folded
into one, and architecture-invariants no longer lists the agent image's CLI set by
hand.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

install.sh

@@ -452,8 +452,9 @@ dsh_banner_probe() {
 # DeepSeek stays a hand-written special case ON PURPOSE: the registry expresses
 # its identity check as `discovery.identity.regex`, a JavaScript regex, and
 # translating that into a `grep` pattern at install time is a transformation
-# nobody should be performing on a security-adjacent check. The parity test pins
-# that the registry still demands "DeepSeek Harness", so an upstream banner
+# nobody should be performing on a security-adjacent check. Instead
+# test/install-sh-invariants.test.ts pins the grep below against the registry's
+# `discovery.identity.regex`, so the two cannot drift apart: an upstream banner
 # change fails a test instead of silently mis-detecting here.
 _cli_candidate_ok() {
     case "$1" in