docs: link every page from the entry points and align CLI text

[ttncode]

What this changes

Closes the whole-branch review of the documentation overhaul (#33–#36).

• docs/README.md reading path now links every tour page, every runbook (including the first-project walkthrough), the key ADRs, docs/decisions/ and docs/PROVENANCE.md, so a from-zero reader reaches every page from README.md.
• publish-a-project.md credits the --no-protect skip to apply_repo_settings; ci-is-red.md drops an unverifiable history claim; ADR mentions in README.md and CONTRIBUTING.md are links.
• scaffold usage() lists what the dispatch already accepts: publish --private, -h, --help, -v, --version. Text only.
• The branch-protection warning in scaffold and the comment in lib/publish.sh cited ADR-0004, which is about keeping the toolbox out of projects; they now cite ADR-0024, which decides the ruleset. tests/publish.bats asserts the corrected message. lib/update.sh's comment names the template's real roots: '["docs"]'.

How it was verified

• Each item checked against the code; independent re-review confirmed all ten.
• bats tests/documentation.bats tests/cli.bats tests/publish.bats tests/update.bats 51/51. mise run test-unit 199/199. mise run lint clean.

Checklist

• mise run lint passes
• mise run test-runner passes — text-only changes; CI runs it
• New behaviour has a test that fails without the change — no behaviour change; the one changed message keeps its assert
• Docs that describe changed behaviour were updated in the same commit
• No unrelated changes