docs: take one site's name, hosts and paths off the public wiki

The publishability gate caught internal tooling names and developer paths but
nothing site-specific, so roughly sixty leaks reached the wiki: the site name in
ten documents, real fleet hostnames in the collector and GE-Enforce examples, an
internal database name through the whole import guide, imaging-share paths, and
a maintainer's username as the Deciders line of every ADR and inside a generated
curl example.

None of it is a security matter on an air-gapped fleet. It matters because these
pages are read by engineers at other plants, and a document that names one site
throughout reads as that site's notes rather than a product's documentation -
which is exactly what it then gets treated as.

Examples now use neutral hostnames, the site is "the reference site" where the
distinction carries meaning, and ADRs are decided by "ShopDB maintainers". The
gate carries all of these patterns, so the next one fails a build.

Two documents leave docs/ because they were never written for an outside reader.
PROJECT-REVIEW.md is an internal health memo pinned to a commit from July, whose
headline finding (an untracked playbook) has since been fixed - it is history,
and git holds it. PILOT-DEPLOY.md is one site's own cutover runbook, complete
with a "re-measure before publishing" placeholder; it moves next to the loader
it belongs to, in scripts/site_imports/wjf/.

ADR-015 is AMENDED rather than rewritten. Its enforcement section still said
report-only and its backlog still listed hardcodes that are now cleared, which
left the record contradicting itself. The amendment says what changed and why
the report-only period ended; the original text stays, because what the decision
looked like when it was taken is the part worth keeping.

Also corrects llms.txt's response envelope, which had errors at the top level
and pagination at meta.total. Both are nested one deeper, so anything written
against that description read undefined on every error it tried to handle.

docs/geenforce-api-cutover.md

@@ -60,7 +60,7 @@ Intune/Entra-joined with no SFLD credentials and no domain trust, so SMB is not
 an option at all. The rest of the fleet CAN stay on the share (and currently
 does); for them the API is an opt-in migration, not a forced one.
 
-West Jefferson facts used throughout this doc:
+the reference site facts used throughout this doc:
 
 | Fact | Value |
 |------|-------|
@@ -244,7 +244,7 @@ never existed on the share. Pattern:
   (Dashboard -> `/shopfloor`, Lobby -> `/tv`, 3DPrintRoom -> `/parts-kiosk`),
   and writes an all-users Startup shortcut (`ShopDB Kiosk.lnk`) launching Edge
   `--kiosk` fullscreen at `{BaseUrl}{route}`. It does NOT Start-Process Edge
-  (see gotchas). Base URL comes from HKLM `BaseUrl`, falling back to the WJ
+  (see gotchas). Base URL comes from HKLM `BaseUrl`, falling back to the reference-site
   host.
 - `seed_display_scope(publish=False)`: `replace_scope_draft`, flush (entries
   need entryids), then `service.store_inline_payload(...)` for each script
@@ -401,7 +401,7 @@ Wow6432Node registry views, every loaded user hive (HKU), Run + RunOnce +
 Policies\Explorer\Run, matching by the legacy value names AND by any value
 pointing at the old URLs; plus every per-user and common Startup folder; then
 kills any running old-URL Edge. A read-only locator,
-`pxe-images/github/find-legacy-kiosk-autostart.ps1`, hunts all these locations
+`<imaging-share>/github/find-legacy-kiosk-autostart.ps1`, hunts all these locations
 (and Edge startup-URL policy, scheduled tasks, Assigned Access) when a straggler
 persists.
 
@@ -612,7 +612,7 @@ The VM rig:
 ## 10. Deploy
 
 TWO independent channels. Confusing them is the classic mistake: the client/
-engine/collector/bootstrap are pxe-images SHARE artifacts, NOT deployed by the
+engine/collector/bootstrap are imaging-share artifacts, NOT deployed by the
 git pipeline.
 
 ### Channel 1: backend + frontend (the git .cmd pipeline)