docs: document Omnigent host integration

[dgokeeffe]

What does this PR do?

Documents the Omnigent host integration shipped in #92, including its opt-in deployment settings, required Apps and UC grants, runtime controls, and identity boundary.

The docs now match the final security design:

• the app-SP client secret remains only in Flask process memory;
• a loopback-only broker mints short-lived OAuth tokens;
• [omnigents-host] stores only the workspace host;
• agent helpers, the host tunnel, and spawned runners receive fresh tokens without a persisted client secret or static bearer.

Evidence

• Documentation-only diff.
• git diff --check.
• Mojibake scan clean across the changed docs.
• Commands and privilege names checked against Makefile and grant_omnigent_host.sh.
• Deployed design evidence is recorded on fix(host): close Omnigent final-review gaps #100.