docs: add x401, rate PAP from its specification, add protocols table and traction charts

[fraseragain]

What changed

• Capability map: adds x401 (Proof, draft 0.2.0) and rates PAP (Poppy, draft 0.1) from its specification text. PAP is no longer provisional. Adds a "Verifier-defined credential requirement" capability. 38 capabilities now (10 overlap, 9 partial, 2 gaps, 17 single owner). Both images are re-rendered.
• PROTOCOLS.md: every protocol on the map with steward, documentation, adoption signals, GitHub and package metrics, and the evidence behind each.
• traction/: scripts and data behind three charts (weekly npm downloads, weekly commits, stars), with no-data and proxy-repository cases marked.
• docs/research/pap-2026-10.md: a review of the PAP draft 0.1 specification, partners, adoption checks and issues filed against it.
• protocol-stack-2026-10.md: PAP and x401 bullets, new counts and category table. The PAP "provisional" wording is replaced.

Evidence and limits

• PAP was read from the draft 0.1 source repository (15 Oct commit): sections 1 to 6, 7.1, 7.2, 7.8, 7.9 in detail; message formats skimmed.
• x401 was rated from draft 0.2.0: design goals, binding, agent identification, security, open questions and changelog read, not all 1,685 lines.
• Adopter lists and usage figures come from search results and are unverified against primary sources. Stated in PROTOCOLS.md.
• Star history over time was not available from the GitHub API, so stars are a snapshot.

How to test

• python3 docs/research/tools/capability-map/generate.py out.html runs for both variants (--no-cheqd too).
• Lint: markdownlint with the repo config and markdown-link-check pass locally on the changed files.

All commits carry a DCO sign-off.

🤖 Generated with Claude Code

[github-actions]

Super-linter summary

Language	Validation result
GITHUB_ACTIONS	Pass ✅
MARKDOWN	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter