docs(P05): verify REQ-349/350/351 pass in combined suite (security-engineer)

---ci---
project: acdl
phase: 5
milestone: v1.28
status: execute
persona: security-engineer
---
Verification results (combined suite, .venv/bin/python -m pytest):

  REQ-349 (mode_resolver property tests, tests/test_mode_resolver.py):
    12 passed — all four priority levels + edge cases (TTY/piped stdout,
    missing credential, conflicting flag/env, invalid env value).

  REQ-350 (KMS round-trip, tests/test_kms_roundtrip.py): 1 passed —
    sign JWT via mock KMS → JWKS Lambda → pyjwt verify (CAP-037, DER→raw
    byte-correct).

  REQ-351 (PAT revocation SLO, tests/test_pat_revocation.py): 2 passed
    — issue → vend → revoke → 403 pat_revoked in <1s (D-229 strong-read).

  Combined suite regression run
  (pytest tests/ --ignore=tests/test_pptx_generator.py -k 'not live_aws
  and not slow'): 1000 passed, 5 deselected, 0 failed.

Fix: the first regression run flagged 1 failure —
test_no_forge_mentions_in_synced_files (REQ-230 v1.20 guard) caught two
forbidden forge-name mentions in the new docs (operator-guide §7,
developer-guide §9). Rephrased both to 'internal forge' / 'internal
forge runner' to keep the docs sync-safe. No code changes. Re-ran the
full suite: 1000 passed, 0 failed.

docs/developer-guide-auth.md

@@ -284,7 +284,7 @@ this is the integrity guarantee for local-review attestations.
 
 ## 9. Service-account PATs (CI usage)
 
-A CI system (GitHub Actions, Gitea `act_runner`) uses a service-account
+A CI system (GitHub Actions, or an internal forge runner) uses a service-account
 PAT to run `nova apply` non-interactively.
 
 ```sh

docs/operator-guide-idp.md

@@ -240,7 +240,7 @@ with `old_key_id`, `new_key_id`, `rotated_at`. The rotation is a
 The `nova-cli` Lambda layer (the shared dependency bundle:
 `argon2-cffi`, `cryptography`, `pyjwt`, `kj` binary) is republished
 **automatically on every merge to `main`** by the P1 Wave 4 publish
-workflow (`.gitea/workflows/publish.yml` + `.github/workflows/publish.yml`).
+workflow (the byte-identical GitHub + internal-forge workflow files).
 On a successful publish, the new layer version ARN is written to SSM
 `/nova/layer/nova-cli/version`.