docs(v3.9.1): add Download & run button + Install page (docker run first)

- Introduction (site root) gains a prominent Download & run button + GitHub
  releases link at the top, styled with theme vars (adapts light/dark).
- New /v3.9/install page leads with the simple one docker run, then the
  attested image + digest + SLSA verify command, the pinned composition
  (PG17 · pgRDF 0.6.19 · pgCK 0.4.21 · cklib 1.5.3 · NATS 2.14.2), and the
  GitHub release links for the bundle + each component repo.
- Sidebar Part V: Build now leads with Install & Run, then Quickstart.
Public-safe only: image/digest/versions/repos; no internal consumer, host, or
deploy details.

Author: styk-tv

docs/.vitepress/config.mts

@@ -93,8 +93,9 @@ export default withMermaid(defineConfig({
         {
           text: 'Part V: Build',
           items: [
-            { text: 'The Client: cklib', link: '/v3.9/client' },
+            { text: 'Install & Run', link: '/v3.9/install' },
             { text: 'Quickstart', link: '/v3.9/quickstart' },
+            { text: 'The Client: cklib', link: '/v3.9/client' },
             { text: 'The Fleet', link: '/v3.9/ecosystem' },
           ]
         },

docs/v3.9/install.md

@@ -0,0 +1,87 @@
+---
+title: "Install & Run"
+description: "Run the whole CKP v3.9.1 substrate with one docker run — the attested ck-allinone image, its SLSA provenance, what it composes, and the GitHub releases."
+---
+
+# Install & Run
+
+The whole substrate is a single, attested image. One `docker run` stands up PostgreSQL 17, the pgRDF graph engine, the pgCK runtime, NATS, and the browser client — about 128 MB, scratch base, no Python. The only prerequisite is Docker.
+
+## One `docker run`
+
+```sh
+docker run --rm -d --name ckp \
+  -e OCIGER_CK_PARTICIPANT_PASSWORD='choose-a-password' \
+  -p 5432:5432 -p 8000:8000 -p 4222:4222 -p 9222:9222 \
+  ghcr.io/sporaxis-com/ociger-ck-allinone:v0.7.28
+```
+
+That single command gives you a complete **CKP v3.9.1 — Critical Isolation** substrate:
+
+```
+PostgreSQL 17  +  pgRDF (graph engine)  +  pgCK (concept-kernel runtime)
+NATS core :4222  +  NATS WebSocket :9222   (the only door for apps)
+busybox httpd :8000  serving /cklib/ (the browser client) + a landing probe
+```
+
+- **Set `OCIGER_CK_PARTICIPANT_PASSWORD`.** Without it the participant role exists but cannot log in, so the isolation floor is never cosmetic.
+- **Open `http://localhost:8000/`** — the landing page runs a live round-trip in your browser and shows ✓ when the wire is alive.
+- **Persist `/var/lib/postgresql/data`** with a volume to keep sealed data across restarts.
+
+Then [drive it with cklib](/v3.9/quickstart) — activate a kernel, land a sealed task, verify its proof.
+
+## The image is attested
+
+The bundle publishes with SLSA Build Provenance v1. Pull it, then verify the provenance before you trust it:
+
+```sh
+docker pull ghcr.io/sporaxis-com/ociger-ck-allinone:v0.7.28
+
+gh attestation verify \
+  oci://ghcr.io/sporaxis-com/ociger-ck-allinone:v0.7.28 \
+  --repo sporaxis-com/oci-germination
+```
+
+| | |
+|---|---|
+| **Image** | `ghcr.io/sporaxis-com/ociger-ck-allinone:v0.7.28` |
+| **Digest** | `sha256:c652647fed8e433a4668b3cac590175ddbb65a1bf9472e04504ca19b0d9a1dfa` |
+| **Provenance** | SLSA Build Provenance v1 — verified before publication |
+| **Pull** | public, anonymous |
+
+## What it composes
+
+The image is a tested composition of the fleet, pinned to exact versions:
+
+| Layer | Version |
+|-------|---------|
+| PostgreSQL | 17.10 (pgcrypto auto-installed on first boot) |
+| [pgRDF](https://github.com/styk-tv/pgRDF) — the graph engine | 0.6.19 |
+| [pgCK](https://github.com/styk-tv/pgCK) — the concept-kernel runtime | 0.4.21 |
+| [cklib](https://github.com/ConceptKernel/CK.Lib.Js) — the client, served at `/cklib/` | 1.5.3 |
+| NATS core / WebSocket | 2.14.2 (`:4222` / `:9222`) |
+
+The protocol is **CKP v3.9.1**; the door is `ckp.dispatch(verb, kernel_urn, payload, identity)`.
+
+## GitHub releases
+
+Every release below is CI-built and provenance-attested, with a `LATEST.md` in each repository confirming the verified head.
+
+- **The bundle** — [sporaxis-com/oci-germination releases](https://github.com/sporaxis-com/oci-germination/releases) (`ck-allinone`, the runnable image above)
+- **The runtime** — [styk-tv/pgCK releases](https://github.com/styk-tv/pgCK/releases) (the PostgreSQL extension; also an `oras`-pullable OCI artifact)
+- **The client** — [ConceptKernel/CK.Lib.Js releases](https://github.com/ConceptKernel/CK.Lib.Js/releases) (`cklib`, dispatch-only)
+- **The engine** — [styk-tv/pgRDF releases](https://github.com/styk-tv/pgRDF/releases) (RDF/SPARQL/SHACL/OWL-RL)
+
+## Behind a gateway
+
+The bundle's NATS WebSocket is on `:9222`. On a direct `docker run` an app opens `ws://<host>:9222`. Behind a TLS gateway, route `/wss` → `:9222` and apps open `wss://<host>/wss`. The bundled landing page auto-detects which case it is from its own URL.
+
+::: warning Alpha-trust today
+Identity is currently the participant role's shared password, not a per-user verified claim. The isolation floor is real — the role can call `ckp.dispatch` and nothing else — but treat a deployment as alpha-trust and do not expose it to untrusted users as-is. Per-user verified-JWT identity is an inherited upstream prerequisite (CKP v3.9 §10).
+:::
+
+## Continue
+
+- [Quickstart](/v3.9/quickstart) — drive the running substrate with cklib.
+- [The client: cklib](/v3.9/client) — the handle and its verb map.
+- [The fleet](/v3.9/ecosystem) — the runtime, client, engine, and bundle behind the image.

docs/v3.9/introduction.md

@@ -5,6 +5,22 @@ description: "Sovereign, semantic, self-governing state reached through one type
 
 # Introduction to CKP v3.9.1
 
+<div class="ck-cta">
+  <a class="ck-cta-btn" href="/v3.9/install">⬇&nbsp; Download &amp; run</a>
+  <a class="ck-cta-alt" href="https://github.com/sporaxis-com/oci-germination/releases">GitHub releases</a>
+  <span class="ck-cta-note">one <code>docker run</code> · ~128&nbsp;MB · Docker only</span>
+</div>
+
+<style>
+.ck-cta{display:flex;flex-wrap:wrap;align-items:center;gap:.6rem;margin:1.1rem 0 1.6rem}
+.ck-cta-btn{display:inline-block;background:var(--vp-c-brand-1);color:var(--vp-c-white)!important;font-weight:600;padding:.5rem 1.15rem;border-radius:8px;text-decoration:none;transition:background .2s;white-space:nowrap}
+.ck-cta-btn:hover{background:var(--vp-c-brand-2)}
+.ck-cta-alt{display:inline-block;border:1px solid var(--vp-c-divider);color:var(--vp-c-text-1)!important;padding:.5rem 1rem;border-radius:8px;text-decoration:none;transition:border-color .2s;white-space:nowrap}
+.ck-cta-alt:hover{border-color:var(--vp-c-brand-1)}
+.ck-cta-note{font-size:.8rem;color:var(--vp-c-text-2)}
+.ck-cta-note code{font-size:.78rem}
+</style>
+
 A Concept Kernel is a self-governing unit of meaning. Its types are ontology — RDF classes, SHACL shapes, OWL-RL rules, not hand-rolled columns. Every change it makes is **shape-gated, sealed, and proof-chained** the moment it lands, and it answers the world through a single typed verb carried over NATS-WSS. Meaning is the schema; the door is the whole surface.
 
 It runs inside PostgreSQL, but the engine stays out of sight: no REST endpoint, no SQL handle, no query surface is exposed. The meaning is sovereign, every step it has taken is provable, and the only thing that crosses the boundary is one verb and its typed payload. This is **CKP v3.9.1 — Critical Isolation**: the engine stays invisible, the meaning stays sovereign, and the proof chain stays whole.