docs: document library crate, exec and rootfs cache apis

README gains a Library section covering prepare, the exec options
(envp, bind targets, arch) and the provisioned-rootfs hot-cell flow.
SPEC documents the workspace layout, the library API, the cache
sidecars (.digest, .provisioned) and the updated execution flow.
AGENTS.md scope paths follow the new crates/ layout.

AGENTS.md

@@ -30,19 +30,26 @@ Rules:
 
 - Types: `feat`, `fix`, `refactor`, `perf`, `test`, `docs`, `build`,
   `ci`, `chore`.
-- Scopes match the component touched — the module name under `src/`:
-  - `cli` — entry point and flags (`src/main.rs`, `src/cli.rs`)
-  - `config` — config file (`src/config.rs`)
-  - `distro` — distro definitions and mirrors (`src/distro.rs`)
-  - `download` — image download (`src/download.rs`)
-  - `extract` — rootfs extraction (`src/extract.rs`)
-  - `chroot` — chroot setup (`src/chroot.rs`)
-  - `namespace` — Linux namespaces (`src/namespace.rs`)
-  - `mount` — bind mounts and mount table (`src/mount.rs`)
-  - `kernel` — kernel/initramfs handling for `--kernel` (`src/kernel.rs`)
-  - `qemu` — QEMU VM mode (`src/qemu.rs`, `src/qemu_vm.rs`)
-  - `utils`, `verbose` — shared helpers (`src/utils.rs`,
-    `src/verbose.rs`)
+- Scopes match the component touched — the module name under
+  `crates/ecr/src/` (library) or `crates/ecr-cli/src/` (CLI):
+  - `cli` — entry point and flags (`crates/ecr-cli/src/main.rs`,
+    `crates/ecr-cli/src/cli.rs`)
+  - `rootfs` — cache-aware preparation and persistence
+    (`crates/ecr/src/rootfs.rs`)
+  - `exec` — namespace-mode execution API (`crates/ecr/src/exec.rs`)
+  - `config` — config file (`crates/ecr/src/config.rs`)
+  - `distro` — distro definitions and mirrors (`crates/ecr/src/distro.rs`)
+  - `download` — image download (`crates/ecr/src/download.rs`)
+  - `extract` — rootfs extraction (`crates/ecr/src/extract.rs`)
+  - `chroot` — chroot setup (`crates/ecr/src/chroot.rs`)
+  - `namespace` — Linux namespaces (`crates/ecr/src/namespace.rs`)
+  - `mount` — bind mounts and mount table (`crates/ecr/src/mount.rs`)
+  - `kernel` — kernel/initramfs handling for `--kernel`
+    (`crates/ecr/src/kernel.rs`)
+  - `qemu` — QEMU VM mode (`crates/ecr/src/qemu.rs`,
+    `crates/ecr/src/qemu_vm.rs`)
+  - `utils`, `verbose` — shared helpers (`crates/ecr/src/utils.rs`,
+    `crates/ecr/src/verbose.rs`)
   - `deps` — dependency additions/bumps (manifests, lockfile)
 - Omit the scope entirely for repo-wide changes that do not belong to a
   single component (README.md, SPEC.md, root config).