docs: take one site's name, hosts and paths off the public wiki

The publishability gate caught internal tooling names and developer paths but
nothing site-specific, so roughly sixty leaks reached the wiki: the site name in
ten documents, real fleet hostnames in the collector and GE-Enforce examples, an
internal database name through the whole import guide, imaging-share paths, and
a maintainer's username as the Deciders line of every ADR and inside a generated
curl example.

None of it is a security matter on an air-gapped fleet. It matters because these
pages are read by engineers at other plants, and a document that names one site
throughout reads as that site's notes rather than a product's documentation -
which is exactly what it then gets treated as.

Examples now use neutral hostnames, the site is "the reference site" where the
distinction carries meaning, and ADRs are decided by "ShopDB maintainers". The
gate carries all of these patterns, so the next one fails a build.

Two documents leave docs/ because they were never written for an outside reader.
PROJECT-REVIEW.md is an internal health memo pinned to a commit from July, whose
headline finding (an untracked playbook) has since been fixed - it is history,
and git holds it. PILOT-DEPLOY.md is one site's own cutover runbook, complete
with a "re-measure before publishing" placeholder; it moves next to the loader
it belongs to, in scripts/site_imports/wjf/.

ADR-015 is AMENDED rather than rewritten. Its enforcement section still said
report-only and its backlog still listed hardcodes that are now cleared, which
left the record contradicting itself. The amendment says what changed and why
the report-only period ended; the original text stays, because what the decision
looked like when it was taken is the part worth keeping.

Also corrects llms.txt's response envelope, which had errors at the top level
and pagination at meta.total. Both are nested one deeper, so anything written
against that description read undefined on every error it tried to handle.

docs/COLLECTOR-INTEGRATION.md

@@ -80,7 +80,7 @@ owner is an admin - it cannot act with admin authority anywhere.
 1. Settings > API Tokens > New Token.
 2. Check **Restrict permissions**, then in the permissions grid tick only
    **Submit collector payloads (fleet reporting)** (the `collector.ingest`
-   permission under the Collector category). Name it (e.g. `wj-fleet-collector`),
+   permission under the Collector category). Name it (e.g. `fleet-collector`),
    optionally set an expiry, Create.
 3. Copy the `shopdb_pat_...` secret (shown once) and deploy it to the fleet the
    same way as the env key: the `collectorApiKey` field in per-site
@@ -138,7 +138,7 @@ Response body (HTTP 200), wrapped in the standard envelope
     "status": "ok",
     "action": "created",
     "assetid": 12345,
-    "identityvalue": "WJRP2335",
+    "identityvalue": "SHOPPC2335",
     "warnings": ["unknown operating system: Microsoft Windows 11 Enterprise 23H2 (build 22631)"]
   },
   "message": "computers collector created",
@@ -337,7 +337,7 @@ Before (no longer works - the key is ignored and the request is rejected 401):
 POST /api/collector/computers?api_key=SECRET
 Content-Type: application/json
 
-{ "hostname": "WJRP2335", "machinenumber": "2335" }
+{ "hostname": "SHOPPC2335", "machinenumber": "2335" }
 ```
 
 After (correct):
@@ -347,7 +347,7 @@ POST /api/collector/computers
 X-API-Key: SECRET
 Content-Type: application/json
 
-{ "hostname": "WJRP2335", "machinenumber": "2335" }
+{ "hostname": "SHOPPC2335", "machinenumber": "2335" }
 ```
 
 PowerShell before/after: