docs: 重写 README

internal/updater/doc.go

@@ -26,10 +26,9 @@
 //     verified 2026-07-05) so Felis's UA is load-bearing there; PaperMC does NOT
 //     enforce (a bare request got HTTP 200 on 2026-07-04) so its UA is only etiquette.
 //     Also: felis-api's topology coord is now the real repository slug, not a placeholder,
-//     so that component resolves at runtime like the others — but only with a credential.
-//     The repo is private, so an unauthenticated poll gets GitHub's 404-for-hidden-repo and
-//     degrades to "latest unknown"; FELIS_GITHUB_TOKEN is what lights it up. k3s and
-//     cloudflared are public and need none.
+//     so that component resolves at runtime like the others, unauthenticated. A private
+//     fork answers an unauthenticated poll with GitHub's 404-for-hidden-repo and degrades
+//     to "latest unknown"; FELIS_GITHUB_TOKEN is what lights it up there.
 //
 //   - ALSO BUILT + UNIT-VERIFIED: the VersionGatherer's extraction core and dispatch.
 //     Three pure extractors turn raw system text into a Version — a `--version` banner

internal/updater/github.go

@@ -40,9 +40,9 @@ type github struct {
 	baseURL   string // e.g. "https://api.github.com"
 	userAgent string // MUST be non-empty — GitHub 403s a UA-less request
 	// token is an optional credential. Empty means unauthenticated, which is the right
-	// posture for the public repos Felis tracks (k3s, cloudflared) and is what the
-	// 60-req/h note above is about. It is load-bearing only for felis-api's own repo
-	// while that repo is private, where its absence does not look like an auth failure:
+	// posture for the public repos Felis tracks (felis-api, k3s, cloudflared) and is what
+	// the 60-req/h note above is about. It is load-bearing only when felis-api is built
+	// from a private fork, where its absence does not look like an auth failure:
 	// GitHub answers 404 — not 401 or 403 — for a private repo the caller cannot see, so
 	// "no token" is indistinguishable from "no release published yet" by status alone.
 	// latestStable says both in the error rather than making an operator guess.