Add a Codex role-profile authoring and policy guide

[Punisheroot]

Context

Canonical Codex role profiles, immutable revisions, the HTTP/editor workflow,
and session provenance are implemented and offline validated. The current
configuration documentation states the field constraints, but contributors
still have to reconstruct practical role-by-policy examples and the safe
authoring workflow from several source and test files.

Outcome

Add a focused docs/ROLE_PROFILES.md guide showing how to author and review
Codex role profiles without changing runtime behavior. Link it from the
documentation index and the existing configuration guide.

Scope

• Explain the six supported roles: explorer, implementer, test runner,
  reviewer, verifier, and auditor.
• Provide a compact field and policy matrix derived from the canonical
  RoleProfileDefinition contract.
• Show complete illustrative configurations for a read-only role, an isolated
  implementer, and a certified-test role. Use obviously synthetic but
  schema-valid model and digest values; never include credentials, host paths,
  or provider configuration.
• Explain the editor workflow: request-time preflight, save immutable draft,
  inspect revision/history/audit state, explicitly activate or deactivate, and
  handle a stale state digest by refreshing rather than overwriting.
• Explain that activation does not launch a worker and that new hook/MCP
  sessions bind an explicitly selected active revision.
• Link the new guide from docs/README.md and docs/CONFIGURATION.md.

Non-goals

• Rust, TypeScript, HTTP, persistence, schema, policy, or editor behavior
  changes.
• Model ladders, ModelPolicy, host-neutral projection, Claude Code/Cursor
  configuration, credentials, provider execution, or lifecycle orchestration.
• Adding machine-readable presets that Needle would automatically import or
  activate.

Acceptance criteria

• Every documented field and policy value matches the current canonical
  role-profile source and tests.
• The role matrix clearly distinguishes read-only, isolated-write, and
  certified-test combinations without suggesting an invalid policy.
• The three examples contain the complete input field set, use only safe
  synthetic values, satisfy the documented validation rules, and cannot be
  mistaken for credentials or auto-imported configuration.
• Draft, preflight, activation, deactivation, history, audit, state-digest,
  hook selection, and MCP selection semantics match current behavior.
• The guide states that configuration and activation do not authorize or
  start a provider turn.
• Links from the documentation index and configuration guide resolve.

Starting points

• crates/needle-core/src/role_profile.rs
• crates/needle-core/src/role_profile/tests.rs
• crates/needle-app/src/server/role_profiles.rs
• crates/needle-app/web/src/pages/role-profiles-editor.tsx
• docs/CONFIGURATION.md
• docs/RUNTIME_AND_WEB_CONTROL_PLANE.md

Validation

Run git diff --check, verify every new relative link, and compare the role and
policy matrix with the focused role-profile tests. No frontend build, provider
credential, network access, or workspace mutation is required.