Document single-pass workstation updates

[priithunt]

What changed

• explain automatic fast, standard, and bounded guarded classification
• document commit-bound verifier receipts and reuse during canary apply
• clarify that full audits and signed releases are exceptional rather than per-commit gates

Why

The workstation is a personal two-Mac environment. Repeating the same verifier
and trust traversal across publication and apply made small configuration
updates unnecessarily slow.

Impact

Readers get a clearer, practical model for keeping strong boundaries without
turning ordinary configuration work into a fleet-release ceremony.

Validation

• scripts/verify-showcase.sh (pass, 1.5 s)
• public files match the curated private showcase source byte-for-byte