Document Turnstile runner protection

Author: adewale

docs/lessons-learned.md

@@ -123,4 +123,4 @@ git diff --check
 - **Journey audit is graph audit plus outcome audit.** A journey section is healthy only when its examples form a prerequisite-respecting mental map and its declared outcomes are backed by cells on those examples. A section can have a beautiful figure and still fail if the support list is a catalog slice, if the `See also` graph isolates one example, or if the section caption describes a conceptual shift the examples do not actually make.
 - **A green total can still hide a weak criterion.** The journey-figure audit found every section figure above the project gate while 15 sections still reused a lesson paint function, which weakened the independence-from-lesson-figures dimension. Bespoke runtime, control-flow, iteration, types, and reliability section figures cleared that watchlist; keep tracking criterion-level weakness even when the aggregate score remains shippable.
 - **Deployment smoke belongs beside CI.** `scripts/smoke_deployment.py` checks rendered Worker pages, runtime-boundary pages, journey pages, prototype review pages, and representative Dynamic Worker POST runs for HTTP failures, exception markers, and stale edited-code output. Build success is not enough; the deployed Worker must render and execute edited examples.
-- **Turnstile should be secret-gated, not development-gated.** Protect edited-code POST runs only when `TURNSTILE_SECRET_KEY` is configured, render the widget only when `TURNSTILE_SITE_KEY` is present, and keep local/dev runs frictionless. If production smoke must POST through a protected endpoint, use a separate `PBE_SMOKE_BYPASS_SECRET` header so smoke remains a deployment check rather than a CAPTCHA solver.
+- **Turnstile should be secret-gated, not development-gated.** Protect edited-code POST runs only when `TURNSTILE_SECRET_KEY` is configured, render the widget only when `TURNSTILE_SITE_KEY` is present, and keep local/dev runs frictionless. If production smoke must POST through a protected endpoint, use a separate `PBE_SMOKE_BYPASS_SECRET` header so smoke remains a deployment check rather than a CAPTCHA solver. See `docs/turnstile-runner-protection-spec.md` for the full runner-protection design.