docs: show mobile decision portal

[abrichr]

What

• Add exact current Desktop phone request and result images with provenance.
• Document the local full-evidence path and the hosted remote-safe path.
• Correct the Desktop decision page data-boundary copy.
• Clarify device pairing, operator identity, signed tasks, and live runner revalidation.

Why

The public Desktop README did not show the mobile decision interface. Existing wording also implied that evidence never left one computer, although the paired phone receives it inside the customer-controlled boundary. The request and result states and their trust boundary were not clear.

Impact

Operators can now see the request, allowed actions, runner receipt, and evidence boundary before installation. This change does not alter runtime decision semantics.

Validation

• uv run pytest -q tests/test_portal tests/test_public_metadata.py — 144 passed
• npm run build — passed
• npm run test:ui — 70 passed
• git diff --check — passed
• Provenance JSON parsed and all image hashes matched