docs: fix all STE prose lint errors across the docs tree - #1047

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/specs/01-spec-minvmd-host-daemon/01-spec-minvmd-host-daemon.md`:
- Around line 249-253: Update the surrounding numbered proof-artifact item to
remove tests/bridge_e2e.rs as an active test, or clearly label it as historical
coverage. Ensure tests/minimald_session_integration.rs is presented as the
authoritative current replacement.

In `@docs/specs/03-spec-networking/03-spec-networking.md`:
- Around line 296-299: Update the UC2a acceptance criterion in the networking
specification to describe the curl result as local HTTP/proxy access rather than
local browser access. Do not claim browser behavior unless the criterion adds a
genuine browser-level verification.
- Around line 443-445: Update the WireGuard implementation decision in this
networking specification to match the contract in architecture.md: select
boringtun for v1 and identify wireguard-go only as the escalation path. Replace
the language implying the choice remains open while preserving the existing
build-chain and maintenance context.
- Line 301: Update the changed proof descriptions in the networking
specification to spell “web server” consistently, including the occurrences near
the local host statement and the additional referenced descriptions. Preserve
the surrounding wording and formatting.

In `@docs/specs/03-spec-networking/architecture.md`:
- Line 123: Remove the stale unresolved-DNS design references from the
architecture document, including the “Unit 3 starts…” statement and the
corresponding assumption-ledger entry. Align the text with the selected
host-side egress proxy design and explicitly preserve that the host resolver is
never consulted.

In `@docs/specs/03-spec-networking/networking-with-diagrams.md`:
- Around line 578-580: Update the sentence beginning “Note that there are
interesting options” to refer to “DNS hostnames” instead of “DNS hosts” and add
an explicit relative clause clarifying that these are the hostnames minimally
created for PTasks and VMs.

In `@docs/specs/05-spec-minvmd-gvproxy-pidfd/05-spec-minvmd-gvproxy-pidfd.md`:
- Around line 71-72: Update the atomic ordering terminology in the
`supervise_switch` documentation from “get/release” to “acquire/release,”
matching the `stopping.load(Ordering::Acquire)` and `store(Ordering::Release)`
behavior while preserving the intentional-versus-unexpected exit classification.

In `@docs/specs/10-spec-diagnostics/10-spec-diagnostics.md`:
- Line 688: In the diagnostics specification’s R6 requirements, move the
requirement labeled R6.6 to after R6.5, preserving its text and restoring
numerical ordering.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@docs/ci-strategy.md`:
- Around line 449-455: Revise the CI strategy documentation to scope the
fork-secrets statement to the repository’s current pull_request-only workflows,
and clarify that requiring code-owner review through branch protection or
rulesets is what makes workflow-changing PRs unmergeable without human approval.
Note that this guidance must be revisited if any workflow moves to
pull_request_target.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@docs/specs/08-spec-vm-ext4-volume/08-spec-vm-ext4-volume.md`:
- Around line 660-662: Revise the “Session UUIDv7” documentation to avoid
asserting that ProviderIndex session IDs cannot collide. Describe UUIDv7
uniqueness as probabilistic and extraordinarily unlikely, or document an
explicit collision detection and handling strategy for ProviderIndex keys.