feat(consolidation): report an attach's credential radius, and rename a server in place

docs/config.mdmodified+26-3

Changes to docs/config.md

		⋯148 linesShow the 148 lines above this hunk@@ -149,9 +149,32 @@ own provider project cannot be attached at all, because its token cannot see the
149	149	owner's box. Co-hosting trades credential isolation for a shared box; that trade
150	150	is often worth making, but it should be a decision rather than a surprise.
151	151
152		-`describeCredentialReach()` and `formatCredentialReach()` report what a given
153		-token actually reaches, separating the owner's boxes from the ones no one asked
154		-for, so the radius can be shown before an attach is approved.
	152	+Every attach deploy states this radius before it acts on it, splitting the
	153	+owner's boxes from the ones nobody asked for:
	154	+
	155	+```
	156	+Attaching to 'statushq' shares one provider project, so this deploy's credential
	157	+can write to all 4 server(s) it can see.
	158	+3 of them belong to neither project:
	159	+ bughq: bughq-production-app
	160	+ stacks: stacks-production-app
	161	+ not managed by ts-cloud: some-legacy-box
	162	+A compromised CI run or a mistargeted teardown in this project now reaches those.
	163	+Keep the app in its own provider project instead if that is not acceptable, which
	164	+rules out attaching.
	165	+```
	166	+
	167	+It is reported, never enforced — the trade is frequently worth making, and a
	168	+deploy that started failing on upgrade would teach operators to silence it
	169	+rather than read it. When the reach is exactly the two projects being joined it
	170	+is one quiet line, because a warning that fires every time is a warning nobody
	171	+reads.
	172	+
	173	+The radius comes from the driver (`CloudDriver.listReachableResources()`), not
	174	+from a global assumption about tokens: a provider whose credential can be
	175	+scoped per-resource simply enumerates less, and the same report comes out
	176	+correct without a special case. `describeCredentialReach()` and
	177	+`formatCredentialReach()` are exported for building your own plan output.
155	178
156	179	### It cannot install services on the owner's box
157	180