docs(readme,cli,packaging): M153 清账四条被排忘的文档类 finding

① README 两版下载表：linux-x64 / linux-arm64 / macos-arm64 / macos-x64 四行补「not yet published /
暂未发布」标记（与 M143 的 windows-arm64 行同款措辞），表后改成「本版只发布 windows-x64」的口径，
并说明发布 job 只留 PUBLISH_SLOTS 里的槽位（现住 release-publish.yml）；顺带把「produced by the CI
matrix」那句改成「矩阵里有、默认发布跑不编、all_slots=true 才编来取证」。

② packaging/make_artifacts.py 两处 docstring 还写 windows-arm64 是 cross-built：按 M140 后的原生
windows-11-arm 事实改写。（release-notes.md 的同一说法在 M139/M142 已改掉，本次核实无残留，未再动。）

③ cli 缺 id 的 hint：删掉「（id 不进仓库）」并改成与 cli/help.rs 一致的「官方构建已内置、环境变量优先、
自建时构建期注入」；Secret 透传的事实留在同处代码注释。

④ README 两版文件清单表：release.yml 从「six-slot build / 六槽位构建」改成「两个 Windows 槽位原生
构建 → 只发布 windows-x64；all_slots=true 才整表六槽位取证」。

纯文案，不动任何构建或运行时逻辑。

packaging/make_artifacts.py

@@ -4,7 +4,7 @@
 Release matrix (see `packaging/README.md` for the full contract):
 
     Windows x64     unlucky-launcher_<ver>_windows_x64.exe      (bare exe, no zip)
-    Windows arm64   unlucky-launcher_<ver>_windows_arm64.exe    (bare exe, cross-built)
+    Windows arm64   unlucky-launcher_<ver>_windows_arm64.exe    (bare exe, native arm64 runner)
     Linux x64       unlucky-launcher_<ver>_linux_x64.tar.gz
     Linux arm64     unlucky-launcher_<ver>_linux_arm64.tar.gz
     macOS arm64     unlucky-launcher_<ver>_macos_arm64.tar.gz
@@ -40,10 +40,11 @@ one is the single writer of the **manifest**, and it derives every sha256/size f
 use this flag: `release-publish.yml` recomputes `SHA256SUMS.txt` after pruning the publish
 whitelist and generates the manifest from *that*, so the manifest always describes what ships.
 
-Slot and build directory are overridable because a cross build's binaries live in
-`target/<triple>/release` and the build host (x64) is not the artifact (arm64): CI
-passes both from its matrix, and the executable header is read back so a binary can
-never be shipped under a slot name it was not built for.
+Slot and build directory are overridable because the build host is not always the
+artifact: a cross build's binaries live in `target/<triple>/release` under an x64
+host, while every native slot (all six in CI, M140) puts them in `target/release`.
+CI passes both from its matrix, and the executable header is read back so a binary
+can never be shipped under a slot name it was not built for.
 
 Usage:
     cargo build --release --locked