Root, CI, docs and packaging describe the project to a stranger (#6225)

#6225 "Comment standard sweep: root, config, CI workflows, docs and
packaging", milestone 546 "Bring the repo to the comment standard (rule 32)
and compose defaults (rule 198)".

- README restructured in newcomer order: what it is, quick start,
  configuration, setup pitfalls, updating and backups, features,
  troubleshooting, development, licence. Its quick-start compose carries
  no restart policy.
- Dockerfile and .env.example trimmed to one or two lines per setting.
- Workflows, packaging scripts and docs lose issue, run, note, rule and
  milestone references and their history narration. Comments that still
  described path filters and "step 6" as future work now state what the
  workflows do.
- ci-requirements.md rewritten against the current workflows. It said the
  build gated on typecheck and lint only, the integration lane did not
  gate, a v* tag published :latest, and ci-tauri lacked bsdtar and zstd;
  none of those is true now (the last checked against run 9630's log).
- Echo strings in guard-forward.sh and version.sh drop their note
  citations; every string a test asserts on is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/android-distribution.md

@@ -22,9 +22,7 @@ copy.
 
 **The channel is a property of the image you run.** A `:dev` image bakes in the
 dev-channel APK, `:latest` the stable one — so pointing a phone at a stable
-server gets it a stable client, with no second place holding that decision. (Until
-M314 step 3 the fetch was hard-wired to the dev release on every branch, so a
-stable server served a dev client.)
+server gets it a stable client, with no second place holding that decision.
 
 An image therefore carries the *newest* client on its channel rather than one
 pinned to a version. That is deliberate: the two negotiate a sync protocol version
@@ -106,5 +104,5 @@ shipped with, which is the whole reason precedence runs in that direction.
 Every release build is signed with the same key, so a phone can install a newer one
 straight over the old one and keep its notes. That was not true before August 2026
 — builds until then were signed with a throwaway key per CI run, and each install
-required uninstalling the last (Scribe #2803). If you are carrying a build from
+required uninstalling the last. If you are carrying a build from
 before that, expect to uninstall once more and sync anything you care about first.