docs: detection techniques -- representations, taint, obligations, ranking, the model's role

New page docs/detection-techniques.md: the three representations (regex over the
file, tree-sitter IR, Joern CPG) and what each can see; Joern as a section of its
own (frontends, one graph per language partition, census as the instrument check,
batching against the measured cost curve, deadlines, degradations, where the engine
sits in the plane, cost and misses with records); taint from fact tables to query to
verdict with each refinement traced to its record or commit; obligations, dominance,
constant abstraction, census; regions, ranking ties and budgets; the residual
question and MAX_JUDGED_CANDIDATES; REGRESS verdicts and the unassigned
execution_confirmed rung; an honest table of what each technique misses.

Nav entry under "How it works" after Scanning; one link from the index; one
cross-link line each in scanning.md and architecture.md.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

docs/architecture.md

@@ -34,7 +34,8 @@ graph per scan with Joern (`joern-parse`, then batched `joern --script` queries
 operation) and configuration (constant abstraction over a value). Taint facts ship for C,
 Java, JavaScript, PHP and Python (`ruleset/semantic/*.toml`). Without Joern the layer records
 `cpg_unavailable` and the scan is otherwise unchanged; the Docker image ships Joern and
-`php-cli` (which the PHP frontend needs).
+`php-cli` (which the PHP frontend needs). The representations and techniques behind each stage
+are explained in [Detection techniques](detection-techniques.md).
 
 The model layer reports on a rung ladder: