docs(readme,cli,packaging): M153 清账四条被排忘的文档类 finding

① README 两版下载表：linux-x64 / linux-arm64 / macos-arm64 / macos-x64 四行补「not yet published /
暂未发布」标记（与 M143 的 windows-arm64 行同款措辞），表后改成「本版只发布 windows-x64」的口径，
并说明发布 job 只留 PUBLISH_SLOTS 里的槽位（现住 release-publish.yml）；顺带把「produced by the CI
matrix」那句改成「矩阵里有、默认发布跑不编、all_slots=true 才编来取证」。

② packaging/make_artifacts.py 两处 docstring 还写 windows-arm64 是 cross-built：按 M140 后的原生
windows-11-arm 事实改写。（release-notes.md 的同一说法在 M139/M142 已改掉，本次核实无残留，未再动。）

③ cli 缺 id 的 hint：删掉「（id 不进仓库）」并改成与 cli/help.rs 一致的「官方构建已内置、环境变量优先、
自建时构建期注入」；Secret 透传的事实留在同处代码注释。

④ README 两版文件清单表：release.yml 从「six-slot build / 六槽位构建」改成「两个 Windows 槽位原生
构建 → 只发布 windows-x64；all_slots=true 才整表六槽位取证」。

纯文案，不动任何构建或运行时逻辑。

README.md

@@ -173,10 +173,11 @@ This list is the reason to believe the rest. None of it is hidden behind marketi
   section*, *Add override*. Each writes `[page] 占位动作 …` to stderr and changes nothing — instance
   management from the GUI is the instance-wizard work still outstanding, and settings change as you
   edit them rather than on a Save.
-- **Linux and macOS artifacts are unverified.** The reference machine is Windows; the `linux-x64`,
-  `linux-arm64`, `macos-arm64` and `macos-x64` archives are produced by the CI matrix and have not
-  been downloaded and run end to end. Treat them as untested output, not as "supported because the
-  matrix lists them".
+- **Linux and macOS artifacts are unverified, and this release does not even build them.** The
+  reference machine is Windows; the `linux-x64`, `linux-arm64`, `macos-arm64` and `macos-x64` slots
+  sit in the CI matrix but the default release run skips them, and they have never been downloaded and
+  run end to end. `gh workflow run release.yml -f all_slots=true` builds them for evidence. Treat them
+  as untested output, not as "supported because the matrix lists them".
 - **macOS is not finalised.** It has two rounds of real-device evidence (Apple Silicon), which is why
   the build exists — but the menu-bar name, the placement of the three window buttons (macOS puts
   them top-left; ours are drawn top-right), and 300s+ steady state still need a real machine. macOS
@@ -207,19 +208,20 @@ Grab the file for your platform from
 |------|-------|-------|
 | `windows-x64` | `unlucky-launcher_<version>_windows_x64.exe` | bare `.exe`, double-click to run |
 | `windows-arm64` | `unlucky-launcher_<version>_windows_arm64.exe` | bare `.exe` — **not yet published**, see below |
-| `linux-x64` | `unlucky-launcher_<version>_linux_x64.tar.gz` | one archive, one top-level directory |
-| `linux-arm64` | `unlucky-launcher_<version>_linux_arm64.tar.gz` | same |
-| `macos-arm64` | `unlucky-launcher_<version>_macos_arm64.tar.gz` | same |
-| `macos-x64` | `unlucky-launcher_<version>_macos_x64.tar.gz` | same |
-| every slot | `ull_<version>_<platform>_<arch>[.exe]` | bare CLI binary, its own asset |
+| `linux-x64` | `unlucky-launcher_<version>_linux_x64.tar.gz` | one archive, one top-level directory — **not yet published** |
+| `linux-arm64` | `unlucky-launcher_<version>_linux_arm64.tar.gz` | same — **not yet published** |
+| `macos-arm64` | `unlucky-launcher_<version>_macos_arm64.tar.gz` | same — **not yet published** |
+| `macos-x64` | `unlucky-launcher_<version>_macos_x64.tar.gz` | same — **not yet published** |
+| every published slot | `ull_<version>_<platform>_<arch>[.exe]` | bare CLI binary, its own asset |
 | all | `SHA256SUMS.txt` | `sha256sum -c` eats it directly |
 
-`windows-arm64` is the one row documented but **not in the current release**: the CI ARM64 runner is
-missing the Windows SDK's ARM64 import libraries — the cause is located and the fix is in progress.
-The row stays because the architecture is still supported and the slot still builds (unpublished) in
-the matrix; what decides whether a slot reaches a Release is `PUBLISH_SLOTS` in
-`.github/workflows/release.yml`, which today names `windows-x64` only — so `windows-x64` is the
-only downloadable Windows asset.
+**This release publishes `windows-x64` and nothing else.** The publish job keeps only the slots named
+in `PUBLISH_SLOTS` (`.github/workflows/release-publish.yml`) and deletes every other artifact before
+it writes `SHA256SUMS.txt`, so a row marked **not yet published** is a naming rule, not a downloadable
+asset. Of those rows `windows-arm64` is the one CI still builds — natively, on GitHub's
+`windows-11-arm` runner, for evidence — but that slot's toolchain check has not gone green yet, so its
+`.exe` stays out of the release. The row stays because the architecture is still supported; it rejoins
+the download list once the build is green.
 
 Each UNIX archive contains the executable plus `LICENSE`, `NOTICE` and `README.md`, in one top-level
 directory. Windows ships a bare `.exe` (a single file cannot carry the texts), so those three
@@ -293,7 +295,7 @@ merge. The macOS probe is not there yet — manual dispatch only, result recorde
 |----------|---------|
 | `.github/workflows/ci.yml` | fmt + clippy + test + release build (Windows / Linux matrix); Linux runtime smoke (Xvfb, one real frame, PNG asserted non-blank); macOS runtime probe (manual dispatch only) |
 | `.github/workflows/guards.yml` | zero-UI guards (`crates/core`, `crates/presenter`, `crates/design`), 400-lines-per-file guard, cargo-deny licence and source guard |
-| `.github/workflows/release.yml` | tag `v*` → six-slot build → single-file artifacts + `SHA256SUMS.txt` → GitHub Release |
+| `.github/workflows/release.yml` | tag `v*` → build both Windows slots (`windows-x64` + `windows-arm64`) on native runners → single-file artifacts + `SHA256SUMS.txt` → GitHub Release (publishes `windows-x64` only; `-f all_slots=true` builds all six slots for evidence) |
 
 ## Architecture and module map