docs: clarify dry-run replay boundary

[MarcoPorcellato]

Summary

• clarify that dry-run is a planning and mount-review surface, not a
  self-contained replay bundle;
• document that copied container argv requires independently validated,
  caller-owned writable mount sources;
• add a deterministic documentation contract and record the change in the
  changelog.

Trust claim checklist

• Public claims in this pull request do not imply:
  • native execution where only contract-level qualification is available,
  • signed identity or full execution attestation when only A0 evidence is present,
  • zero-cost operation or equivalent absolute cost reductions.
• Source/runtime impact is described below; there is no dependency,
  permission, secret, policy, schema, or runtime implementation change.
• No roadmap claim is introduced.

Impact and rollback

• Runtime or trust-boundary impact: documentation now matches the existing
  separation between rendered final cache paths and live per-generation
  staging sources. Runtime behavior is unchanged.
• Dependency or supply-chain impact: none.
• Data, secret, permission, or network impact: none.
• Rollback path: revert the two commits in this PR.

Evidence checklist

• Exact focused and full checks are listed below.
• cargo fmt --all -- --check passed.
• Relevant contract tests and intentionally not-run native gates are recorded.
• git diff --check passed.
• CHANGELOG.md is updated.
• No links were added or changed.

Validation notes

• Exact head: f3fb14a0329cf031d08f474115a8b56fe1cffcf6.
• Local deterministic suite: 375 passed, 3 native opt-in tests ignored, 0
  failed; strict Clippy, docs, release metadata, formatting, and diff hygiene
  passed offline.
• macOS/OrbStack CCP run for this exact head: all five required checks PASS.
• Receipt ID:
  sha256:3536dce784a646f6450f6a228230e09ffff8d4d5bd45f89dfd285223a9a235d1.
• Receipt raw SHA-256:
  624477439b1bdb7b397876a7e5f8434057f8805835162c5fccb21beac015000b.
• Independent local verification: integrity PASS, trusted-plan policy PASS.
• Receipt evidence has not been published; the remote receipt gate is PENDING.
• GitHub main advanced to
  1a2e081cd3912b0fd63a7226a4564f1d85a51eb8 after this head was qualified
  and overlaps CHANGELOG.md and docs/LOCAL_RUN.md. The PR remains draft
  until base integration is reviewed and any changed exact head is freshly
  requalified.
• No stable-binary replacement or global operator-contract update is included.