docs(updater): correct PaperMC UA/fixture overclaims, re-tier the boundary

An out-of-band curl of the live Fill v3 endpoint contradicted two claims the
previous commit shipped and surfaced a mis-tiering:

- User-Agent is NOT enforced: fill.papermc.io/v3/projects/velocity returned
  HTTP 200 to a bare curl UA. The comments claimed a generic UA "is refused"
  and the API "REQUIRES" a contact UA. Reword to what is true — PaperMC's usage
  policy asks for a descriptive UA and may block generic ones, but sending it is
  etiquette/defensive here, not a gate Felis depends on.
- The test fixture's shape was invented, not captured: the real "versions"
  object groups the entire 3.x line under a single key "3.0.0", not the
  per-minor keys the fixture used. Replace it with the real body (keys and
  version strings as returned). The key-agnostic parser already produced the
  right answer, and an independent max-stable check confirms 3.4.0.
- Re-tier doc.go: the GitHub Releases source is verifiable-here (the same
  httptest-testable shape as PaperMC), not integration remainder. It is why
  3 of 4 components report "latest unknown" today and is the next verifiable
  slice — the release-source work is only ~half done until it exists.

No production logic changed. WSL oracle: build + vet clean, internal/updater
10/10, full tree go test RC=0 (19 ok, 0 fail).

internal/updater/doc.go

@@ -11,20 +11,29 @@
 // "the updater works against real infra":
 //
 //   - BUILT + UNIT-VERIFIED (Go tests, WSL oracle): the topology, the PaperMC Fill
-//     v3 parser (its fixture is captured from the REAL live response shape on
-//     2026-07-04 — a grounded contract test, not a self-referential one), the
-//     routing source, and the Runner's report-only composition. These prove the
-//     parse/plan/compose LOGIC and that the core is now wired to a caller.
+//     v3 parser, the routing source, and the Runner's report-only composition. The
+//     PaperMC fixture is captured from the live endpoint, and the live call was
+//     exercised out-of-band on 2026-07-04 (curl fill.papermc.io/v3/projects/velocity):
+//     the response shape matches the fixture and 3.4.0 is confirmed the newest stable
+//     (3.5.0-SNAPSHOT correctly filtered). These prove the parse/plan/compose LOGIC
+//     and that the core is now wired to a caller.
 //
-//   - WRITTEN, NOT LIVE-VERIFIED: the tests assert the required non-generic
-//     User-Agent is transmitted, but real fill.papermc.io network/TLS/UA-enforcement
-//     is not exercised here; the fixture proves today's shape, not its future
-//     stability.
+//   - NOT YET BUILT, but VERIFIABLE HERE (same technique as PaperMC — HTTP GET, JSON
+//     decode, tolerant Parse, prerelease filter, all httptest-testable): the GitHub
+//     Releases source. It is why 3 of the 4 components (felis-api, k3s, cloudflared)
+//     currently report "latest unknown" — RoutingSource returns errGitHubNotWired for
+//     them. This is the next VERIFIABLE slice, not integration remainder; until it
+//     exists the verifiable release-source work is only ~half done.
 //
-//   - REMAINING INTEGRATION (not built here): the GitHub Releases source (felis-api,
-//     k3s, cloudflared — RoutingSource returns errGitHubNotWired for them today), the
-//     concrete VersionGatherer (`k3s --version`, image-tag / jar inspection), the
-//     concrete Notifier (SMTP + in-game) and Applier (control-plane image bump,
-//     cloudflared swap), the `felis update` CLI + CronJob entry point, and the
-//     runtime append of the live Pinned Minecraft fleet.
+//   - CAVEATS on what the tests do NOT prove: they run against httptest, not the live
+//     host, so future upstream shape drift is not caught; and while Felis sends a
+//     descriptive User-Agent (PaperMC etiquette), upstream UA enforcement was not
+//     active on the project endpoint on 2026-07-04 (a bare UA got HTTP 200), so the UA
+//     is defensive, not load-bearing.
+//
+//   - REMAINING INTEGRATION (pure I/O, no verifiable-here logic): the concrete
+//     VersionGatherer (`k3s --version`, image-tag / jar inspection), the concrete
+//     Notifier (SMTP + in-game) and Applier (control-plane image bump, cloudflared
+//     swap), the `felis update` CLI + CronJob entry point, and the runtime append of
+//     the live Pinned Minecraft fleet.
 package updater