docs: align documentation with session fixes

Reconcile docs with the end-to-end pipeline fixes:
- upload/download-artifact @v4 -> @v3 (Gitea GHES) in WORKFLOW-AUTHORING
  and workflow-example.yml; add Common Mistakes rows (v4, action ref
  form + DEFAULT_ACTIONS_URL, public action repo).
- BEST-PRACTICES / README / HOST-SETUP: guest credential must live in
  the LocalSystem vault with a host-qualified username; document
  Set-CIGuestCredential.ps1 / Test-CIGuestWinRM.ps1 and auth=ntlm.
- README / AGENTS / HOST-SETUP: production venv install is NON-editable
  (LocalSystem); no CI workflow may install into it.
- HOST-SETUP: add DEFAULT_ACTIONS_URL=github + full-URL uses: + public
  repo + @main requirements discovered during validation.
- Correct stale repo name local-ci-system -> local-ci-cd-system.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/HOST-SETUP.md

@@ -91,6 +91,32 @@ Apri PowerShell **come Administrator**, poi:
    - Avvia servizio (`SERVICE_AUTO_START`)
 7. **Configura SSH alias `gitea-ci`** in `~/.ssh/config` (HostName, Port, User git)
 
+### Note operative (scoperte in validazione end-to-end)
+
+Setup-Host.ps1 da solo **non basta** per la pipeline Python su runner
+LocalSystem. Dopo Setup-Host:
+
+- **Credenziale guest nel vault SYSTEM, username host-qualificato.** Lo
+  step 4 scrive in Windows Credential Manager dell'utente interattivo →
+  invisibile ad act_runner (LocalSystem). Esegui (elevato):
+  `\.\scripts\Set-CIGuestCredential.ps1 -UserName 'WINBUILD-2025\ci_build'`.
+  Bare `ci_build` viene rifiutato da NTLM (`SEC_E_UNKNOWN_CREDENTIALS`):
+  usa il computer name del guest (= CN del cert WinRM). Diagnostica:
+  `\.\scripts\Test-CIGuestWinRM.ps1 -IpAddress <guest-ip>`.
+- **venv di produzione = install non-editable.** Popola
+  `F:\CI\python\venv` con `python -m pip install .` dal repo reale —
+  **mai** `pip install -e .` (il `.pth` punta a un path che LocalSystem
+  non risolve → `No module named ci_orchestrator`). Vedi
+  `plans/PhaseA-user-checklist.md` Passo 1. Nessun workflow CI deve
+  installare in quel venv (lint usa un venv effimero per-job).
+- **Gitea `app.ini`:** imposta `[actions] DEFAULT_ACTIONS_URL = github`
+  e referenzia l'action col **URL completo**
+  (`https://gitea.emulab.it/Simone/local-ci-cd-system/.gitea/actions/local-ci-build@main`)
+  così le action GitHub (checkout, upload-artifact) restano risolvibili
+  e l'action locale punta all'istanza. Il repo `local-ci-cd-system` deve
+  essere **pubblico** (il runner clona l'action senza autenticazione) e
+  l'action deve esistere su `@main` (il ref che il runner clona).
+
 ---
 
 ## Parametri principali