docs: reconcile to the shipped M9 local-cloud lane (#90)

The M9 lane (specs 26-29) is now built + released (v0.5.0-v0.9.0). Keep the
docs honest (the spec-26 principle):
- README Commands: shell/workspace-list/tunnel-up-down are shipped; add the
  local-cloud verbs (db/s3/queue/topic/stream/resource/aws). logs is the ONLY
  remaining stub.
- README Status: add the M9 bullet (resource layer + Provisioner family +
  cloud-emulation engines).
- FEATURES / ROADMAP: mark the local-cloud lane ✅ SHIPPED.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gustavobertoi

README.md

@@ -160,16 +160,19 @@ devstack secrets ingest .env    # convert a committed .env into secret:// refs +
 | `secrets keygen/ingest/login/logout/status` | ✅ | SOPS+age / AWS / Infisical secrets; `ingest` converts a `.env` into `secret://` refs + vars. |
 | `trust install/uninstall/status` | ✅ | Local-HTTPS CA via `mkcert`. |
 | `dns setup/status/remove` | ✅ | `*.localhost` resolver wiring. |
-| `tunnel login/create/route` | ✅ | Cloudflare tunnel (default down; refuses secret-bearing services). |
+| `tunnel login/create/route/up/down` | ✅ | Cloudflare tunnel (default down; refuses secret-bearing services). |
 | `self check/update` | ✅ | Version check and checksum-verified self-update. |
 | `store init/path/show` | ✅ | The global `~/.devstack` store: config + custom templates + shared defs. |
 | `alias add/remove/list` | ✅ | `argv[0]` alias symlinks (`rq`, `uranus`, …). |
 | `import` | ✅ | Convert a legacy devdock `project.yaml` → the clean-slate two-file schema. |
-| `workspace destroy` / `uninstall` | ✅ | Tear down this workspace's stacks / reverse all machine-global artifacts. |
-| `shell` | 🚧 | Open a shell in a service container (planned). |
+| `workspace list/destroy` / `uninstall` | ✅ | List every registered workspace; tear down this workspace's stacks (`--purge-data` drops provisioned resources) / reverse all machine-global artifacts. |
+| `shell <service>` | ✅ | Open an interactive shell (or `-- <cmd>`) in a service container. |
+| **`db` / `s3` / `queue` / `topic` / `stream`** | ✅ | **Local-cloud data plane** — create tenant-scoped databases + users, S3 buckets + object lifecycle, queues, pub/sub topics, and streams on the shared engines (or declare them in `devstack.yaml resources:`, provisioned at `up`). |
+| `resource list/show/create/rm/gc` | ✅ | Engine-agnostic view + management of every provisioned resource in the ledger. |
+| `aws -- <args>` | ✅ | Run the host `aws` CLI against the local LocalStack/MinIO endpoint (dev creds prefilled). |
 | `logs` | 🚧 | Stream / aggregate service logs (planned — [spec 16](docs/specs/16-logs-and-dashboard.md)). |
 
-Every headline command supports `--json` and `--quiet` for scripting/CI.
+Every headline command supports `--json` and `--quiet` for scripting/CI. **`logs` is the only remaining stub.**
 
 ## The global store (`~/.devstack`)
 
@@ -209,10 +212,9 @@ when unused. See **[ARCHITECTURE.md](docs/ARCHITECTURE.md)**.
 - **M4–M7** — secrets (`secret://` + SOPS+age/AWS/Infisical, no plaintext on disk), networking (Caddy proxy, `mkcert` trust, cloudflared tunnel, `dns`), orchestration glue (health gating, lifecycle hooks, profiles), `doctor --fix`, `workspace destroy`/`uninstall`, and self-update + `devstack import`.
 - **M8 (beta DX)** — `init` wizard, `template new` authoring, `secrets ingest` (`.env` → secrets), and conventional-commit **release automation** (released **v0.2.0+** automatically).
 
-**Next:** the **M9 local-cloud lane** (specs [26](docs/specs/26-cli-completeness.md)–[29](docs/specs/29-resource-commands.md)) — finish the CLI surface (`shell`, `logs`, `workspace list`), then a data-plane **resource layer** (databases/users, S3 buckets + lifecycle, queues, streams) and cloud-emulation **engines** (LocalStack, NATS, Kafka). The only command stubs today are `shell` and `logs`.
+- **M9 (local cloud)** — the CLI-completeness pass (`shell`, `workspace list`, `tunnel up/down`, `up --rebuild/--skip-clone`), a data-plane **resource layer** (a per-engine `Provisioner` family + a declarative `resources:` block + `resource`/`db`/`s3`/`queue`/`topic`/`stream` verbs), and net-new cloud-emulation **engine templates** (LocalStack, NATS, Kafka/Redpanda, RabbitMQ). Databases, users, buckets + object lifecycle, queues, topics, and streams are all tenant-scoped, ledger-tracked, and reachable over `devstack_shared`.
 
-Then: secrets (M4) · networking/local-HTTPS (M5) · orchestrated onboarding + health
-+ hooks (M6) · hardening + GA (M7). See **[ROADMAP.md](docs/ROADMAP.md)**.
+**The only remaining command stub is `logs`** (the full log/dashboard cockpit is [spec 16](docs/specs/16-logs-and-dashboard.md), still v2). Roadmap detail: **[ROADMAP.md](docs/ROADMAP.md)**.
 
 ## Requirements
 

docs/FEATURES.md

@@ -77,7 +77,7 @@ Guided `devstack init`: a Bubble Tea v2 TUI (left engine-picker + right live `wo
 **17. Release automation + 0.x conventional-commit versioning · 0.75w thin (+0.75w wizard) — the v0.2.0 gate.** ([spec 25](specs/25-release-automation.md))
 Conventional commits on `main` → `svu next --v0` → tag + goreleaser **in one workflow** using the built-in `GITHUB_TOKEN` (no PAT/App token), gated by an owner-set `RELEASE_ENABLED` repo variable (default off = the kill-switch); a human-cut tag still releases via the same workflow. Fixes the load-bearing **ldflags v-prefix bug** (`{{.Version}}` stamps `0.1.0`, which `x/mod/semver` rejects) that currently makes the shipped spec-14 update-notifier + `self update` treat a released binary as a dev build and never offer updates. Adds a grouped goreleaser changelog, a PR-title conventional-commit lint, and a CI `v0.*` guard (stay 0.x: BREAKING → minor, never 1.0.0). Optional `devstack release` maintainer wizard. *Everything else in this lane ships through this pipeline — build it first.*
 
-### Local-cloud platform lane (post-M8, v0.x beta; specs 26–29)
+### Local-cloud platform lane (post-M8, v0.x beta; specs 26–29) — ✅ SHIPPED (v0.5.0–v0.9.0)
 
 Turns the shared-infra tool into a **local cloud**: cloud-emulation engines + a first-class data-plane resource layer + the verbs to drive it, plus a CLI/README honesty gate that lands first. Strictly additive over M0–M8; stays 0.x. It generalizes provision-on-demand (Postgres-only today) from one engine to a family. **Build order: #21 (reconcile) first → #20 (substrate) → #19a db/s3 in parallel with #18 (engines) → #19b messaging last.**
 

docs/ROADMAP.md

@@ -92,7 +92,7 @@ Effort is **person-weeks at production OSS quality** (tests + docs + cross-platf
 
 **Sequencing within M8:** M8.0 → M8.1 (lands `internal/prompt` + the shared emitter) → M8.2 (reuses both) → M8.3 (reuses prompt, adds the heaviest net-new backend). After each charm-dep add: re-run `make vuln` + the `CGO_ENABLED=0` static cross-build; no build tags may creep in.
 
-### M9 — Local-cloud platform lane (post-M8, v0.x beta) · **~14w**
+### M9 — Local-cloud platform lane (post-M8, v0.x beta) · **~14w** · ✅ SHIPPED (v0.5.0–v0.9.0)
 > Generalizes provision-on-demand (Postgres-only today) into a full data-plane resource layer and adds cloud-emulation engines, turning the shared-infra tool into a local cloud. Strictly additive; stays 0.x. Specs: [26](specs/26-cli-completeness.md) (CLI/README reconcile) · [27](specs/27-resource-layer.md) (resource model + Provisioner family) · [28](specs/28-cloud-engine-templates.md) (cloud engines) · [29](specs/29-resource-commands.md) (imperative verbs). Every mutation goes through `internal/lock`; engine tools (mc/aws/nats/rpk) shell out behind `internal/` interfaces (CGO-free rule); only generated artifacts are determinism-gated, ledger/runtime ops are not.
 
 **M9.0 — CLI completeness & README reconciliation (the credibility gate) · 2w.** ([spec 26](specs/26-cli-completeness.md))