Align preview documentation and CI with the visible-only contract

[Driedsandwich]

Maintainer-controlled change.

Closes #3 when merged.

Scope

• Concern: public-preview documentation and CI alignment
• Files changed: workflow, public docs, status/manual verification guidance, runtime-boundary regression test
• This stacked Draft depends on Enforce visible-only untrusted extraction #4 and is intentionally based on codex/issue-2-visible-untrusted-extraction.

Verification

• 38/38 automated tests
• Local workflow-equivalent sanity checks
• Manifest permissions remain activeTab, scripting, and clipboardWrite with no host permissions
• Exact-head workflow-dispatch CI succeeded (run 30520517087)
• Official Gitleaks 8.30.1 exact-tree and introduced-range scans: finding 0
• Exact commit loaded with Load unpacked in an isolated headed Chrome for Testing profile
• Public-safe Issue and PR Conversation title, canonical URL, body, comments or explicit fallback, Copy feedback/restoration, and local save verified
• Unsupported repository root generated no Markdown and kept Copy/Download disabled

Boundaries

• No release, tag, package, npm publish, Chrome Web Store operation, visibility change, or Private archive change.
• Keep this PR Draft and unmerged.