[codex] Ground repo reality hygiene

[Jesssullivan]

Summary

• add a dated TCFS workstream reality checkpoint covering GitHub, Linear, distribution, Apple, Linux, K8s, CI, signing, and remote governance fronts
• refresh stale tracker/docs reality after PR [codex] Record tinyland branch prune proposal #351 and mark Formally retire yoga bare SSH remote #313 as documentation-only retired
• fix low-risk repo hygiene: wire tcfs-stack SeaweedFS secret keys to tcfs-backend, make Windows install.ps1 fail honestly while Windows artifacts are disabled, document chart CRD prerequisites, and update stale FileProvider/fleet docs

Validation

• git diff --check
• task docs:links
• task docs:pdf
• yq e '.' .github/workflows/release.yml
• yq e '.' infra/k8s/charts/tcfs-stack/values.yaml
• yq e '.' infra/k8s/charts/tcfs-stack/Chart.yaml
• yq e '.' infra/k8s/charts/tcfs-backend/values.yaml
• bash -n scripts/tcfs-deploy.sh
• helm template tcfs-backend infra/k8s/charts/tcfs-backend --namespace tcfs --set autoscaling.enabled=false --set metrics.serviceMonitor.enabled=false
• temp-dir helm dependency build + helm template for tcfs-stack, verifying SeaweedFS secret/backend key wiring and no ServiceMonitor rendered by default
• bash scripts/test-tcfs-onprem-migration-plan.sh
• bash scripts/test-tcfs-onprem-tofu-candidate-workloads.sh
• bash scripts/test-tcfs-onprem-preflight.sh

Refs #280
Refs #309
Refs #312
Refs #327
Refs #298