docs: add DESIGN.md

[chaodu-agent]

Summary

Adds DESIGN.md: why this project exists and where each design decision lives in the code.

Explicitly not a second design of record — the ADR in openabdev/openab keeps that role. This document adds the two layers this repo was missing:

• The five tenets (any agent, any sandbox-capable environment, remote agents with a local feel, detach/re-attach from any device, sandbox as a MUST) — each mapped to the mechanism that delivers it and the test/measurement that verifies it
• Implementation map for contributors and reviewers: the two invariants, load-bearing startup order, per-module responsibilities, generation fence, close-code rationale

Also includes an honest status table (delivered vs client-side vs unverified vs roadmap — e.g. EKS/GKE marked "expected to work, unverified", agent-to-agent communication marked "not in this repository") and a non-goals section so a well-meaning PR doesn't reverse a decision the ADR already made.

Verified

• Every cited fact checked against source: image.yml variant matrix (14 variants incl. native), main.rs startup order, lib.rs invariants, contract §7 latency figures
• All relative links target files present in the repo

Docs only, no code changes.