docs: add working-with-state standard; home both standards in-repo

[rianjs]

Summary

• Adds docs/working-with-state.md — the non-secret on-disk state standard (config + cache) and the LOCKED rollout plan. Companion pillar to the Secret-Handling Standard.
• Homes working-with-secrets.md in docs/ (clean move from a loose unversioned ~/dev/ file) so both standards co-version with the cli-common code they govern.
• Updates README.md to reference both standards in-repo (the prior "maintained outside this repository / not published" note no longer holds).

Standard highlights (working-with-state.md)

• Config → os.UserConfigDir()/<dir>, Cache → os.UserCacheDir()/<tool>, via a shared cli-common state resolver; native per-OS, no hand-rolled current/target path resolution (bespoke legacy probes exempt).
• Rollout: commons-first, port one unit at a time (a unit = a CLI / a credential scope / a cache-only surface); jtk-cache first and independent; Atlassian shared config is one combined cfl+jtk unit; per-port §3.2 migration acceptance matrix as a merge gate; 7-var hermetic test isolation.

Review provenance

Pressure-tested through 5 Codex architect rounds (gpt-5.5, xhigh). Round 1 caught 2 blockers + 6 majors (real factual errors fact-checked against the sibling repos — all fixed). Converged at round 5: blockers=0 majors=0 minors=0 nits=0. Full per-finding disposition is in §7 of the doc.

Test plan

• Docs-only + README change — no code; make check unaffected (verify CI).
• Confirm both standards render and the README in-repo links resolve.
• Follow-ups (not this PR): build the cli-common state components; per-unit ports.

Closes #15
[MON-5362]

[rianjs]

Major resolved. On PR head 8419a6c, the cli-deployment-manifest.md references in docs/working-with-secrets.md are now code spans, not relative Markdown links.

No regressions seen: changed files remain exactly README plus the two docs; README links still point to files added by the PR; working-with-state.md is unchanged from the converged version.