docs(repo): mark the Free-plan environment split as observed, cite GitHub Docs

[marcusjacobson]

Summary

Docs plane: correct the provenance of the GitHub Free-plan environment note in Getting started §2 — the deployment-branch-policy availability on Free private repos is empirically observed behavior, not something GitHub's documentation guarantees — and add the missing citation. Post-merge follow-up from the PR #123 downstream verification (the operations repo's empirical finding).

Plane and scope

• infra/** (control plane, Bicep)
• data-plane/** (data plane, YAML)
• scripts/** (data-plane apply logic)
• .github/workflows/** (CI/CD)
• docs/** or README.md (documentation)

Also index.html (regenerated embeds — required whenever an embedded doc changes) and CHANGELOG.md. Single plane: docs only.

Change detail

• Reword the > [!NOTE] GitHub-plan block in docs/getting-started.md §2: the claim "deployment branch policies work on all plans" becomes an explicitly observed result (REST accepted deployment_branch_policy on a GitHub Free private repo, verified 2026-07-16; required reviewers rejected with HTTP 422), contrasted with what GitHub actually documents — "Users with GitHub Free plans can only configure environments for public repositories" and "Some features for environments have no or limited availability for private repositories", with no per-feature breakdown as of 2026-07-16 (Managing environments for deployment). Interim-posture guidance (branch policy + per-environment OIDC subject per ADR 0010 §3) unchanged.
• Regenerate index.html embedded doc snapshots (Update-LandingPageEmbeds.ps1; -Check passes).
• CHANGELOG entry under 2026-07-16 → Documentation.

Validation evidence

Update-LandingPageEmbeds.ps1 -Check → Embedded docs are current (5 docs), exit 0
WebFetch of the cited GitHub Docs page (2026-07-16) confirms the quoted availability wording;
the page does NOT document the per-feature Free-private split — which is exactly why the note
now labels it as observed behavior.
Doc-only change: bicep/yaml/powershell/pester gates unaffected (validate runs on the PR).

Security review

• No secrets, keys, tokens, or real tenant/subscription/object IDs in the diff
• No new identities
• No publicNetworkAccess changes
• No role-assignment changes

Rollback plan

Revert the single docs commit(s); no state, workflow, or script behavior is touched.

Breaking / destructive

None — prose-only.

🤖 Generated with Claude Code

[github-actions]

Owner Gate

Ready for lab-owner approval. All checks are passing and this PR carries needs-review.

To approve, run @owner-approval in Copilot Chat, or run:

gh pr edit 124 --add-label owner-approved

---

This comment is maintained automatically by the pr-owner-gate workflow. It updates on every push and label change. Re-toggle the needs-review label to refresh after a check completes.

[github-actions]

Owner Gate

Ready for lab-owner approval. All checks are passing and this PR carries needs-review.

To approve, run @owner-approval in Copilot Chat, or run:

gh pr edit 124 --add-label owner-approved

---

This comment is maintained automatically by the pr-owner-gate workflow. It updates on every push and label change. Re-toggle the needs-review label to refresh after a check completes.