docs: fix first-day default-path accuracy (USAi, backend primacy, dead links) - #345

…d links)

First-day default-path (msb) doc-accuracy batch from the audit epic
#335. Docs only — no acq/backend/config change.

#337 — repointed the broken local `docs/CODING_PRACTICES.md` references (that
file lives in the playbook, not here — "reference, don't restate") to the
canonical playbook URL used already by AGENTS.md/QUICKSTART_SBX.md: 5 sites in
CONTRIBUTING.md + the CONTEXT-GUIDE.md table row; dropped the non-existent path
from CONTEXT-GUIDE.md `related_files`. (checklists/pre-deployment.md:11 is the
same defect but is deferred — it collides with open PR
#344; will fold in after that merges.)

#336 — defined USAi on first mention in README ("the GSA-hosted LLM gateway at
api.gsa.usai.gov") and reconciled the misleading "Nothing to get in advance" key
row: the code hard-aborts without a key (acq.backends/common.sh), so the row now
says "Required, but acq guides you" and flags that non-interactive/CI has no
prompt and needs the key set in advance.

#338 — resolved the competing backend-primacy claims. QUICKSTART_SBX's
"Recommended for federal users" steered readers to the NON-default backend;
replaced it with a note that msb is the default and this guide is for when you
specifically want sbx. Surfaced the real msb constraint where a reader chooses
(BACKEND_GUIDE "Known limitations"): acq can auto-install only opencode on msb;
other agents must be pre-baked into ACQ_MSB_IMAGE.

#343 — the sandbox no longer "clones" the playbook after the #327 heal-probe
moved to an AGENTS.md marker (delivery is a pinned REST tarball, patterns
v1.8.0+). Fixed the stale "clones" prose at 4 user-facing sites the audit's 2
cites missed (README x2, risk-assessment x2) to delivery-accurate wording.

#340 (quickstart) — the QUICKSTART msb export block leaked the key into shell
history and read as a normal default step. Marked it interactive-vs-non-interactive,
cross-linked the safe `acq secret set -g usai` flow, and replaced the inline
`export KEY=<...>` with a `read -rs` prompt that never lands in history/argv.

markdownlint clean (10 files); new/changed external URLs verified 200.

Refs #335 #336 #337 #338 #340 #343

Co-authored-by: OpenCode Agent <[email protected]>