docs(t1): trace the transport seam to the two javascript.rs chokepoints; remove dead execution.rs site-markers

Resolved the desktop servicing path (service.rs:2198 handle_javascript_sync_rpc_request) but corrected the T1
interception to the PAYLOAD TRANSPORT seam per the Phase-1 design: response chokepoint = javascript.rs:1323
respond_sync_rpc_success (json_to_cbor_payload -> response writer); request chokepoint = the sync-RPC receive path.
T1 edits write/read the cbor record to/from the K->G / G->K ring (via with_ring_backing_slices, sidecar stays
forbid-unsafe), gated on the per-session ring handoff. Removed the two dead [t1-site] markers from execution.rs
(child/http arms the desktop never hits). Baseline multi-app run today: builds clean, runs to exit 0, but PARTIAL
(blank, no app window) -- the wall T1 targets. Full seam map in T1-SAB-RING-SECURITY-DESIGN.md.

Author: NathanFlurry