Expand vision.md into the full product vision (#1055)

Complete the core-concept definitions (tool, source, connection, secret,
scope, policy, plugin, manager/invoker) and add: the core/first-party/one-seam/
surfaces model; composition via artifacts x surfaces and the kind/lifetime/
origin/surface/delivery axes; scope merging (ordered merged scopes, three fixed
rules, org|user as the two-element case, dimension-vs-indirection); connections,
secrets and the tool-proxy invariant; source kinds and the normalized manifest;
policies attached to source and connection (connection overrides source, scope
authority layered, toolkits carry no policy); toolkits as pure curation;
the capability membrane; surfaces (MCP meta-tools, MCP apps with RSC UI, MCP
channels, authoring tools); the two authoring paths (file+deploy and tool over
MCP) with promotion; the two-substrate storage split (git/Cloudflare Artifacts
for authored artifacts, KV/SQLite/FS for agent state); the Run model;
human-in-the-loop; sandbox/runtime; distribution/CLI/remotes; cloud plugins;
principles; the build discipline (evolve not rewrite, the wedge, vision-vs-build
mode); north-star scenarios; and open questions.

Author: RhysSullivan