feat: pos tree — print the CLI command tree

pos tree derives the hierarchy live from bin/pos-* filenames + # POS:
/# POS_SUBCMDS: headers, so it always matches what the dispatcher can
run. Category-less tool (like pos-config); --depth N limits nesting.

Also sharpen the agent-facing docs that the work exposed:
- AGENTS.md: drop the stale "one category-less exception" claim; document
  the category-less pattern (pos-config, pos-tree) and that gen only reads
  the text after the first em-dash in # POS: headers
- DEV.md: category-less vs categorized rule + header extraction note
- AGENT_Context "Adding a New Tool": new step 0 — pin the exact CLI verb
  and runtime context (dev/repo-only vs installed) before writing code
- POS.md: new config + tree sections; category-less tools get their own
  sections
- README: pos tree bullet following the pos X convention

DOC/POS.md

@@ -14,6 +14,8 @@
   - [communication](#communication)
   - [entertainment](#entertainment)
   - [flags](#flags)
+  - [config](#config)
+  - [tree](#tree)
 - [Legacy wrappers](#legacy-wrappers)
 
 ---
@@ -48,6 +50,8 @@ Every non-interactive `pos` invocation logs to `~/.local/share/linux_post_instal
 
 ## Commands
 
+Category-less tools (`config`, `tree`) live outside any category and are documented in their own `###` sections below.
+
 ### network
 
 | Command | File | Purpose | Configuration |
@@ -301,6 +305,25 @@ Feature-flag management CLIs (see [SCRIPTS.md → lib/flags.sh](SCRIPTS.md#libfl
 | `flag-set <name> [value]` | Set a flag, optionally with a value (requires sudo) |
 | `flag-clear <name>` | Unset a flag (requires sudo) |
 
+### config
+
+`pos config` is the interactive editor for the tools' runtime config (see [DEV.md](DEV.md#config-files) and §10 of AGENT_Context). Every tool exposes its configuration by declaring a `# POS_CONFIG:` header; `pos config` reads those at runtime — it knows nothing about the variables themselves. Values live in `~/.config/linux_post_install/<scope>.env` (chmod 600).
+
+| Command | Purpose |
+|---------|---------|
+| `pos config` | Scope picker (on a TTY), otherwise the scope list |
+| `pos config <scope>` | Edit that scope's variables (masked secrets, validation, `-` to clear) |
+| `pos config <scope> set KEY=VALUE` | Set a value non-interactively (each tool's `config set` form) |
+
+### tree
+
+`pos tree` prints the `pos` command tree — every category, command, and subcommand the dispatcher can reach, annotated with each tool's `# POS:` description. Data is derived live from the `bin/pos-*` filenames and their `# POS_SUBCMDS:` headers, so it always matches what `pos` can actually run.
+
+| Command | Purpose |
+|---------|---------|
+| `pos tree` | Full command tree |
+| `pos tree --depth N` | Limit nesting depth (1 = root only) |
+
 ---
 
 ## Legacy wrappers