Root, CI, docs and packaging describe the project to a stranger (#6225)

#6225 "Comment standard sweep: root, config, CI workflows, docs and
packaging", milestone 546 "Bring the repo to the comment standard (rule 32)
and compose defaults (rule 198)".

- README restructured in newcomer order: what it is, quick start,
  configuration, setup pitfalls, updating and backups, features,
  troubleshooting, development, licence. Its quick-start compose carries
  no restart policy.
- Dockerfile and .env.example trimmed to one or two lines per setting.
- Workflows, packaging scripts and docs lose issue, run, note, rule and
  milestone references and their history narration. Comments that still
  described path filters and "step 6" as future work now state what the
  workflows do.
- ci-requirements.md rewritten against the current workflows. It said the
  build gated on typecheck and lint only, the integration lane did not
  gate, a v* tag published :latest, and ci-tauri lacked bsdtar and zstd;
  none of those is true now (the last checked against run 9630's log).
- Echo strings in guard-forward.sh and version.sh drop their note
  citations; every string a test asserts on is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/should-build.sh

@@ -5,27 +5,21 @@
 #
 #   should-build.sh <desktop|android> <dev|stable>
 #
-# Note 3127 §4, skip-if-exists — adapted, because §4 assumes a registry keyed by
-# VERSION and rule 145 removed exactly that. There is no `:<version>` tag to ask
-# about. What there IS, for both clients, is a channel that publishes the version it
-# is serving, and that answers the same question: if the channel already serves what
-# this source derives, the artifact would be byte-identical and there is nothing to
-# build.
+# Skip-if-exists, keyed on what the channel serves rather than on a registry tag:
+# there are no `:<version>` tags to ask about. Both clients' channels publish the
+# version they serve, so if the channel already serves what this source derives,
+# the artifact would be byte-identical and there is nothing to build.
 #
-# WHAT THIS REPLACES, and why that matters more here than the cost saving: the
-# `paths:` filters in the workflows were a SECOND, independent statement of each
-# artifact's file set, hand-kept beside the one in `version.sh`. They disagreed
-# within a day of the sets being written — `packaging/` was added to the sets and
-# not to the filters, so the commit that fixed a derivation bug never ran on the two
-# lanes it fixed (85ead4d). §3 warns about exactly this duplication; one definition
-# with one reader is the fix, and the cost saving is a bonus.
+# This is also why the workflows carry no `paths:` filters: a second, hand-kept
+# statement of each artifact's file set beside the one in `version.sh` drifts from
+# it, and a lane whose filter misses a file never runs on the commit that changed
+# it. One definition with one reader; the cost saving is a bonus.
 #
 # THE SERVER IS NOT LISTED HERE, DELIBERATELY. Its image build is ~15 seconds against
 # 6 and 9 minutes for the clients, so there is little to save — and always building
 # it is strictly better for a server that can face the internet, because it picks up
-# `python:3.12-slim` base updates on every push. That is also why the base-image
-# tension in §4 does not bite this project: the artifact most exposed to it never
-# skips. The clients' bases are CI runner images, pinned deliberately.
+# `python:3.12-slim` base updates on every push. The clients' bases are CI runner
+# images, pinned deliberately.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
@@ -64,9 +58,7 @@ if [ "$derived" = "$published" ]; then
   # produce the same artifact under the same name and republish it for nothing.
   #
   # Skipping is safe here in a way it would not be if anything pinned: there is no
-  # immutable tag to re-push with different bytes (rule 145 removed version tags),
-  # so the immutability argument in §4.2 does not apply and this stands on cost
-  # alone — which is the smaller, honest claim.
+  # version tag to re-push with different bytes, so this stands on cost alone.
   echo "should-build: $channel already serves $artifact $derived — skipping." >&2
   echo false
   exit 0