Clarify CF Tunnel SSH is power-user only — client install required, browser IDE is zero-install

OPEN_THREADS.md

@@ -75,20 +75,20 @@ Completed:
 2. Dev container `provisioningComplete` state in `/status`
 3. Graceful shutdown verification (SIGTERM + wait for Minecraft)
 4. Process reattachment on agent restart
-5. SSH server install in dev container provisioning pipeline
+5. SSH server install in dev container provisioning pipeline (for CF Tunnel SSH)
 
 ---
 
 ## Dev IDE Access
 
-### Browser IDE ✅ Fully Working (browser-verified)
+### Browser IDE ✅ Fully Working (browser-verified) — Zero Install
 
 ```
 Browser → dev-<vmid>.zerolaghub.dev → Traefik → API → container:6000
 ```
 
-Browser-verified: VS Code loads in browser at `dev-6070.zerolaghub.dev/?folder=/home/dev/workspace`
-with workspace mounted, extensions panel visible, AI chat panel active.
+This is the primary zero-install access method. VS Code in the browser,
+no client software required. Browser-verified and production ready.
 
 ### Remaining Work
 
@@ -96,7 +96,13 @@ with workspace mounted, extensions panel visible, AI chat panel active.
 - reduce legacy `/__ide/:id` compatibility paths once portal button confirmed
 - simplify and harden `devProxy` — remove stale path-based assumptions
 
-### Local Dev Access — SSH via CF Tunnel (In Progress)
+### Local Dev Access — SSH via CF Tunnel (Power Users Only)
+
+**Important:** CF Tunnel SSH requires `cloudflared` installed on the
+developer's local machine. This is not zero-install and is an optional
+feature for power users who want local VS Code or terminal access.
+
+The browser IDE remains the zero-install story for all developers.
 
 See `knowledge-base/network/cf-tunnel-ssh.md` for full detail.
 
@@ -108,13 +114,6 @@ Current state:
 - ⏳ Dev container SSH server not yet verified
 - ⏳ Portal SSH config snippet not yet built
 
-Developer one-time SSH config (once complete):
-```
-Host *.zerolaghub.dev
-    ProxyCommand cloudflared access ssh --hostname %h
-    User dev
-```
-
 ---
 
 ## API (zpack-api)
@@ -152,7 +151,7 @@ Completed:
 Outstanding:
 
 - confirm "Open IDE" button fully uses hosted URL flow
-- SSH config snippet for local VS Code / terminal access
+- SSH config snippet for power users (optional, clearly labeled as requiring cloudflared install)
 - site copy/wording — needs rewriting for public audience
 
 ---
@@ -177,7 +176,7 @@ Outstanding before launch:
 
 Future work:
 
-- CF Tunnel SSH access completion (see Local Dev Access above)
+- CF Tunnel SSH completion — power user feature, requires client cloudflared install
 - artifact version promotion
 - runtime rollback support
 - Cloudflare R2 for large artifact/mod file delivery at scale