docs: align documentation with session fixes

Reconcile docs with the end-to-end pipeline fixes:
- upload/download-artifact @v4 -> @v3 (Gitea GHES) in WORKFLOW-AUTHORING
  and workflow-example.yml; add Common Mistakes rows (v4, action ref
  form + DEFAULT_ACTIONS_URL, public action repo).
- BEST-PRACTICES / README / HOST-SETUP: guest credential must live in
  the LocalSystem vault with a host-qualified username; document
  Set-CIGuestCredential.ps1 / Test-CIGuestWinRM.ps1 and auth=ntlm.
- README / AGENTS / HOST-SETUP: production venv install is NON-editable
  (LocalSystem); no CI workflow may install into it.
- HOST-SETUP: add DEFAULT_ACTIONS_URL=github + full-URL uses: + public
  repo + @main requirements discovered during validation.
- Correct stale repo name local-ci-system -> local-ci-cd-system.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

README.md

@@ -158,12 +158,16 @@ Python sub-commands listed below.
 ### Setup
 
 ```powershell
-# Production venv on the runner host (one-time)
+# Production venv on the runner host (one-time + on every code deploy).
+# NON-editable: act_runner runs as LocalSystem and cannot resolve an
+# editable .pth into the dev tree or a transient RunnerWork dir
+# (-> "No module named ci_orchestrator"). Re-run `pip install .` after
+# each code change. No CI workflow may install into this venv.
 python -m venv F:\CI\python\venv
 F:\CI\python\venv\Scripts\python.exe -m pip install --upgrade pip
-F:\CI\python\venv\Scripts\python.exe -m pip install -e ".[dev]"
+F:\CI\python\venv\Scripts\python.exe -m pip install .
 
-# Local dev venv (NOT committed; see .gitignore)
+# Local dev venv (NOT committed; see .gitignore) — editable is fine here
 python -m venv .venv
 .\.venv\Scripts\python.exe -m pip install -e ".[dev]"
 ```
@@ -294,10 +298,12 @@ Dettagli: [docs/LINUX-TEMPLATE-SETUP.md](docs/LINUX-TEMPLATE-SETUP.md).
 ### 2. Credenziali guest
 
 ```powershell
-# PowerShell elevato — una volta sola sull'host
-Import-Module CredentialManager
-New-StoredCredential -Target "BuildVMGuest" -UserName "ci_build" `
-    -Password "<your-build-password>" -Persist LocalMachine
+# PowerShell elevato — una volta sola sull'host.
+# Scrive nel vault SYSTEM (act_runner gira come LocalSystem; un
+# New-StoredCredential dalla sessione utente NON sarebbe leggibile dal
+# runner). Username host-qualificato col computer name del guest
+# (bare 'ci_build' -> NTLM SEC_E_UNKNOWN_CREDENTIALS).
+.\scripts\Set-CIGuestCredential.ps1 -UserName 'WINBUILD-2025\ci_build'
 ```
 
 ### 3. act_runner