docs: open-source model support, egress-allowlist correction, nav regrouping

[xuefei-wang]

Docs-only. Three independent changes, one commit each.

1. Document open-source / self-hosted model support

Nothing in the docs said which providers KSI accepts, or what running an
open-weight model would involve. MODEL_PROVIDER takes only anthropic and
openai — there is no vllm, ollama, or openrouter provider.

Adds a page covering the high-level shape rather than an implementation spec,
since this is a future contribution:

• How you'd wire it — put a proxy speaking the Anthropic Messages format in
  front of the model and reuse the existing SDK path, rather than writing a
  provider adapter. The Claude Agent SDK honors ANTHROPIC_BASE_URL /
  ANTHROPIC_AUTH_TOKEN, and the runner already forwards environment into it.
• Why it half-works today — host-side phases (forum, distillation,
  reflection) can be redirected right now; the containerized agent can't,
  because the base-URL variables aren't forwarded into the container.
• What it affects — egress allowlist, prompt caching, cost reporting,
  structured output, and the direct adapters that bypass the SDK.
• What to expect — multi-turn tool-calling robustness is the real risk, not
  the plumbing.

Includes a warning that setting a base URL today doesn't error — it splits
traffic between the local server and the hosted API, which is the confusing
failure mode. A brief version lands in the FAQ.

2. Correct the egress-allowlist recipe in architecture

docs/architecture.md documented
KSI_EGRESS_ALLOW=host bash scripts/run_ksi.sh ... as the way to allowlist a
custom provider endpoint. That variable is only read from the TypeScript
runner's process.env, which the Python CLI builds from the provider profile
plus a fixed system-key list — so a shell-exported value never reaches
deriveEgressAllowlist and the documented form silently no-ops.

Found while researching change 1. Notes the constraint instead of leaving a
recipe that appears to work. No code change here; flagging it as a real gap.

The existing unit test passes env straight into derive(), so it exercises
the function but not the plumbing that feeds it.

3. Regroup nav so pages sit under what they're about

Three placements didn't match content:

Page	Was	Now
Running larger runs	Programmatic API	Getting started
Your own tasks	standalone tab	Getting started
Benchmarks	after Reference	before FAQ

"Running larger runs" documents CLI flags and explicitly frames ksi.run(...)
as a layer over the parser it describes — it opens by naming its own place in
the progression after the quickstart and your-own-tasks walkthroughs. Grouping
those three makes the new-user path one sequence.

Contributing was also misplaced under "Getting started", but #11 landed the same
observation independently while this was in review and promoted it to a
top-level tab. Rebased onto that decision rather than overriding it.

Landing-page cards track the change (they were deliberately unified with the nav
tabs in 7f99358).

Verification

• mkdocs build --strict passes (validates nav and internal links).
• Page URLs derive from file paths, not nav position — /experiments/,
  /benchmarks/, /CONTRIBUTING/ all render at unchanged paths, so no links
  break.
• No orphaned pages: every file under docs/ is reachable from the nav.
• Rebased onto Fix new-user friction: doctor diagnostics, reasoning_effort validation, quickstart, docs #11, which touched all four files this branch edits plus
  src/ksi/providers.py. Re-ran the profile loader against the rebased code to
  confirm the base-URL claims still hold: MODEL_PROVIDER is still limited to
  anthropic/openai, and ANTHROPIC_BASE_URL / ANTHROPIC_AUTH_TOKEN are
  still dropped by load_provider_profile.

Claims about SDK behavior were checked against the shipped packages
(@anthropic-ai/claude-agent-sdk@0.1.77, @openai/agents@0.8.5) and the
half-works/doesn't-work split was confirmed by running the profile loader and
runner-env builder directly.

🤖 Generated with Claude Code