docs: align documentation with session fixes

Reconcile docs with the end-to-end pipeline fixes:
- upload/download-artifact @v4 -> @v3 (Gitea GHES) in WORKFLOW-AUTHORING
  and workflow-example.yml; add Common Mistakes rows (v4, action ref
  form + DEFAULT_ACTIONS_URL, public action repo).
- BEST-PRACTICES / README / HOST-SETUP: guest credential must live in
  the LocalSystem vault with a host-qualified username; document
  Set-CIGuestCredential.ps1 / Test-CIGuestWinRM.ps1 and auth=ntlm.
- README / AGENTS / HOST-SETUP: production venv install is NON-editable
  (LocalSystem); no CI workflow may install into it.
- HOST-SETUP: add DEFAULT_ACTIONS_URL=github + full-URL uses: + public
  repo + @main requirements discovered during validation.
- Correct stale repo name local-ci-system -> local-ci-cd-system.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

gitea/workflow-example.yml

@@ -9,7 +9,7 @@
 #   windows-build  ->  WinBuild2025  (WinRM/HTTPS transport)
 #   linux-build    ->  LinuxBuild2404 (SSH transport)
 #
-# The composite action (Simone/local-ci-system/.gitea/actions/local-ci-build)
+# The composite action (Simone/local-ci-cd-system/.gitea/actions/local-ci-build)
 # handles the full VM lifecycle: clone template -> start -> build ->
 # collect artifacts -> upload to Gitea -> destroy VM.
 # No orchestration logic needed in each repo's workflow.
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       # ── Invoke the full VM lifecycle via composite action ───────────────────
-      - uses: Simone/local-ci-system/.gitea/actions/local-ci-build@main
+      - uses: https://gitea.emulab.it/Simone/local-ci-cd-system/.gitea/actions/local-ci-build@main
         with:
           # --- adapt these two per-repository -----------------------------------
           build-command:   'python build.py --dist-dir dist'   # command run in VM
@@ -63,7 +63,7 @@ jobs:
       # Step 4: Upload artifacts even on failure (for diagnostics)
       - name: Upload diagnostic logs on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: build-logs-${{ github.sha }}
           path: F:\CI\Artifacts\${{ github.run_id }}-${{ github.run_attempt }}\*.log
@@ -140,7 +140,7 @@ jobs:
 #
 #       - name: Upload artifacts (${{ matrix.target }})
 #         if: success()
-#         uses: actions/upload-artifact@v4
+#         uses: actions/upload-artifact@v3
 #         with:
 #           name: build-${{ matrix.target }}-${{ github.sha }}
 #           path: F:\CI\Artifacts\${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.target }}\
@@ -154,7 +154,7 @@ jobs:
 # The composite action handles: Invoke-CIJob.ps1 call + artifact upload + log upload.
 #
 # Reference: gitea/actions/local-ci-build/action.yml in this repository.
-# Deployed path in Gitea: Simone/local-ci-system / .gitea/actions/local-ci-build/action.yml
+# Deployed path in Gitea: Simone/local-ci-cd-system / .gitea/actions/local-ci-build/action.yml
 #
 # Minimum example (Windows build, Python project with submodules):
 #
@@ -171,7 +171,7 @@ jobs:
 #     runs-on: windows-build
 #     steps:
 #       - uses: actions/checkout@v4
-#       - uses: Simone/local-ci-system/.gitea/actions/local-ci-build@main
+#       - uses: https://gitea.emulab.it/Simone/local-ci-cd-system/.gitea/actions/local-ci-build@main
 #         with:
 #           build-command: 'python build_plugin.py --final --dist-dir dist'
 #           artifact-source: 'dist'
@@ -188,7 +188,7 @@ jobs:
 #     runs-on: ${{ matrix.target }}-build
 #     steps:
 #       - uses: actions/checkout@v4
-#       - uses: Simone/local-ci-system/.gitea/actions/local-ci-build@main
+#       - uses: https://gitea.emulab.it/Simone/local-ci-cd-system/.gitea/actions/local-ci-build@main
 #         with:
 #           build-command: 'python build_plugin.py --final --dist-dir dist'
 #           artifact-source: 'dist'