[johnnyhuy]

Part of #85
Closes #110

What changed: the guest demo user now actually exists in the catalog. Added user:default/guest in examples/users/guest.yaml with memberOf readers, plus the readers, developers and admins groups named by the permission policy in examples/groups/. Made the guest userEntityRef explicit in app-config.yaml to match production, and added docs/demo-baseline.md (in the mkdocs nav) stating what a guest can and cannot do.

How it was verified:

• mise run install - passed
• mise run lint - passed (packages/backend 1 file, permission module 3 files, theme 1 file, plausible 8 files, packages/app 46 files, no errors)
• mise run test - passed: 3 suites passed, 1 skipped, 21 tests passed (was 16). New tests in plugins/permission-backend-module-default/src/module.test.ts: allows the guest demo user to read, denies the guest demo user the create action, denies the guest demo user the update action, denies the guest demo user the delete action, denies the guest demo user scaffolder actions.
• mise run dev - frontend on localhost:3000 and backend on localhost:7007 both came up. Signed in as guest in a browser and opened /catalog/default/user/guest. The page rendered the Guest user with a Readers group link, which proves the new entities are ingested and the guest can read the catalog. Frontend and config only in effect, plus catalog sample data, so mise run build (Docker image) was not run.

Proof:
Browser snapshot of /catalog/default/user/guest after guest sign-in showed the USER Guest heading, the guest email, and a Readers link in the membership list. The screenshot command (agent-browser screenshot) hung twice and was terminated, so no PNG is attached. Capture method: agent-browser snapshot succeeded, PNG capture was blocked. The test and lint transcripts above are the behaviour proof for the policy change, and docs/demo-baseline.md is itself the document proof for the config part.

Known gaps and follow-ups:

• Signed-in GitHub and GitLab users still need manual membership in developers to write. Automating that mapping is a separate slice.
• The parent epic Release demo-ready developer portal experience #85 stays open. Remaining scope includes stability checks for a shared public deployment.
• Johnny: no design or taste call was made here. The look of a public landing page under Ship public showcase landing page with Gumroad-style direction #84 is still yours to direct.