fix: correct documented vs actual behavior discrepancies from subworker audit

- Fix verify.md --changed exit code (0 → 2)
- Add 'deep' as alias for 'thorough' in generation profile resolution
- Fix PLUGIN_CONTRACTS_SPEC status: Partially implemented (registry done, runner pending)
- Fix OUTBOUND_CONTRACT_MOCKING_SPEC status: Implemented (Phase 1)
- Fix cli.md environment matrix to match actual code granularity
- Fix chaos.md: document delay handler is currently a no-op
- Fix getting-started.md warning: note APOPHIS does not proactively detect nondeterminism
- Add variants section to getting-started.md
- Build: clean | Tests: 849 pass, 0 fail

docs/cli.md

@@ -255,10 +255,12 @@ apophis replay --artifact reports/apophis/failure-*.json
 |---|---|---|---|---|
 | `verify` | enabled | enabled | optional | optional, usually off |
 | `observe` | optional | optional | enabled | enabled |
-| `qualify: scenario` | enabled | enabled | enabled with allowlist | disabled by default |
-| `qualify: stateful` | enabled | enabled | synthetic-only | disabled by default |
-| `qualify: chaos` | enabled | enabled | canary-only | disabled by default |
-| outbound mocks | enabled | enabled | allowlisted only | disabled by default |
+| `qualify` | enabled | enabled | optional | disabled by default |
+| `chaos` | enabled | enabled | optional | disabled by default |
 | runtime throw-on-violation | optional | optional | exceptional | disabled by default |
 
-Operational rule: Production must never inherit qualify capabilities accidentally from a generic config file.
+Notes:
+- `qualify` is gated as a whole. The code does not distinguish scenario, stateful, and chaos sub-modes in environment policy.
+- `chaos` on protected routes requires `allowChaosOnProtected: true`.
+- `observe` blocking requires `allowBlocking: true`.
+- Production must never inherit qualify capabilities accidentally from a generic config file.