EQL: user-facing docs in packages/eql/docs duplicate the docs repo and are stale (v3 only) #1316

Problem

The docs repo is the source of truth for user-facing documentation, but packages/eql/docs still carries its own copy, imported with the EQL package. The reference pages teach the v3 surface only (e.g. reference/database-indexes.md has v3 examples and nothing for v4 or unique indexes), so they already disagree with the published docs and will drift further.

User-facing pages (move to the docs repo if anything is missing there, then delete):

• concepts/WHY.md
• reference/database-indexes.md, eql-functions.md, json-support.md, permissions.md, query-performance.md, sql-support.md
• tutorials/proxy-configuration.md
• upgrading/v2.3.md, v3.0.md, v3.0.5.md, v3.1.md
• reference/schema/eql-payload-v2.2.schema.json, eql-payload-v2.3.schema.json (check whether anything still consumes these)

Contributor docs that arguably stay in the repo: development/*, plans/*, reference/adding-a-scalar-encrypted-domain-type.md, reference/catalog-driven-architecture.md.

Things that reference the folder

• packages/eql/README.md links to docs/reference/database-indexes.md, permissions.md, sql-support.md and docs/tutorials/proxy-configuration.md.
• packages/eql/tasks/test/docs_v3_grep.sh scans the user-facing doc surface for eql_v2 references; update its scope or remove it.
• AGENTS.md, DEVELOPMENT.md, SUPABASE.md, the EQL changelogs and two .changeset files also mention paths under docs/.

Proposal

1. Diff each user-facing page against the docs repo and port anything missing (v4 content goes straight to the docs repo).
2. Delete the user-facing pages and replace docs/README.md with a pointer to the docs repo plus an index of the contributor docs.
3. Repoint the README links and update or remove docs_v3_grep.sh.
4. Add a CI guard that refuses new user-facing pages under packages/eql/docs.