[codex] Ground TCFS release and platform claims

[Jesssullivan]

Summary

• tighten README/docs index install snippets around Ubuntu 24.04+ / Debian 13+, Nix tagged-profile install, Linux FUSE scope, and non-production PZM FileProvider proof
• update generated release text to require explicit container architecture pulls and keep macOS Finder/FileProvider experimental
• refresh architecture/FileProvider docs and ops runbooks so K8s, on-prem, PZM mutation/conflict, and issue-map wording match current evidence
• make legacy mutating Justfile deploy/tofu apply recipes require an explicit environment instead of defaulting to Civo
• add release workflow regression assertions for the new release-note proof boundaries

Validation

• bash -n scripts/test-release-workflow-container.sh
• shellcheck scripts/test-release-workflow-container.sh
• task lazy:test-release-workflow-container
• just --list
• git diff --check
• task docs:links
• task docs:pdf
• task lazy:check

Proof Boundary

This is a truthing/docs patch. It does not add new production Finder evidence, Kubernetes rollout evidence, Linux packaged FUSE/systemd first-use evidence, or current-tag native arm64 container registry proof.