docs: adoption means curl canonical, never cp a sibling

[hunterdsp]

The Required-files table says standard.mk is "vendored verbatim" without saying verbatim from where — and that gap is how the second adopter ended up unguarded on its first day.

doppler adopted by taking the file from just-makeit's working tree, which at that moment held the pre-publication copy where STANDARD_URL was still empty and opt-in. Nothing went red: the copy passed every gate and reported

standard-check: inert

which reads like a pass. doppler ran for a day with no drift protection at all while its make lint was green — exactly the fail-open that making the URL a default was meant to eliminate. Fixed by re-vendoring (doppler-dsp/doppler#559).

The default only works if the adopter fetches the file that carries it, so adoption is now one explicit command:

curl -fsSL -o standard.mk https://just-buildit.github.io/standard.mk

with the two consequences that cost time here spelled out:

• arming-by-default protects only an adopter that vendors the current canonical — a copy from a sibling carries that sibling's arming policy as of whenever it was taken;
• after canonical changes, adopters do not update themselves. Their gate goes red, which is correct and is the point; the fix is to re-fetch, never to edit the vendored copy. An adopter whose gate is inert is the one case that will not tell you.