docs: align documentation with session fixes

Reconcile docs with the end-to-end pipeline fixes:
- upload/download-artifact @v4 -> @v3 (Gitea GHES) in WORKFLOW-AUTHORING
  and workflow-example.yml; add Common Mistakes rows (v4, action ref
  form + DEFAULT_ACTIONS_URL, public action repo).
- BEST-PRACTICES / README / HOST-SETUP: guest credential must live in
  the LocalSystem vault with a host-qualified username; document
  Set-CIGuestCredential.ps1 / Test-CIGuestWinRM.ps1 and auth=ntlm.
- README / AGENTS / HOST-SETUP: production venv install is NON-editable
  (LocalSystem); no CI workflow may install into it.
- HOST-SETUP: add DEFAULT_ACTIONS_URL=github + full-URL uses: + public
  repo + @main requirements discovered during validation.
- Correct stale repo name local-ci-system -> local-ci-cd-system.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

TODO.md

@@ -177,7 +177,7 @@ _Last updated: 2026-05-11 (post Sprint 15: §7.5 DONE — Rinomina Setup-* → I
 - [x] `gitea/workflows/lint.yml` creato — PSScriptAnalyzer su push/PR che toccano `.ps1` (2026-05-09)
 - [x] **[P3] Adattare workflow per altri repository** — generalizzare `BUILD_COMMAND` e `ARTIFACT_SOURCE`.
       COMPLETATO 2026-05-11: `gitea/workflow-example.yml` riscritto per usare la composite action
-      `Simone/local-ci-system/.gitea/actions/local-ci-build@main`. Commenti inline guidano
+      `Simone/local-ci-cd-system/.gitea/actions/local-ci-build@main`. Commenti inline guidano
       la personalizzazione di `build-command`, `artifact-source`, submodules, SSH URL,
       `extra-guest-env-json` e `artifact-name`. Nessuna logica di orchestrazione nei repo chiamanti.
 
@@ -488,7 +488,7 @@ jobs:
     runs-on: windows-build   # or linux-build
     steps:
       - uses: actions/checkout@v4
-      - uses: Simone/local-ci-system/.gitea/actions/local-ci-build@main
+      - uses: Simone/local-ci-cd-system/.gitea/actions/local-ci-build@main
         with:
           build-command: 'python build_plugin.py --final --dist-dir dist'
           artifact-source: 'dist'
@@ -526,7 +526,7 @@ Artifact separati: `nsis-plugin-nsinnounp-windows-<tag>` e `nsis-plugin-nsinnoun
 
 Usage dal workflow:
 ```yaml
-- uses: Simone/local-ci-system/.gitea/actions/local-ci-build@main
+- uses: Simone/local-ci-cd-system/.gitea/actions/local-ci-build@main
   with:
     build-command: 'python sign_and_build.py'
     extra-guest-env-json: '{"SIGN_PASS":"${{ secrets.SIGN_PASS }}","CERT_THUMBPRINT":"${{ secrets.CERT_THUMBPRINT }}"}'