Fix CI: untrack docs prose, correct two stale frontend specs

wilm has been red for eight consecutive runs across backend, gates and
frontend. Three failures, two unrelated causes, neither introduced by the
endpoint agent work.

docs/ prose (backend + gates):
The docs gates detect a published checkout by the ABSENCE of docs/*.md,
because docs/ becomes the wiki on that side. DEV-BUILD-TEST.md and
PLUGIN-HOOKS.md were committed in unrelated changes, which made CI look
like an internal checkout carrying almost no prose. test_there_are_docs_
to_check then failed on `assert 3 > 20`, test_the_map_itself_is_current
failed on a generated PROJECT-MAP.md that is correctly untracked, and
check-gates-ran.sh failed on the resulting skip - a skipped gate reports
green and checks nothing, so it refuses to accept one.

The existing .gitignore comment predicted this exactly and was defeated by
naming files individually. Untracked both (kept on disk) and replaced the
per-file list with docs/*.md so the next authored doc cannot reintroduce
it. Scoped to the top level: docs/notes/ prose and docs/openapi.json stay
tracked, and the gates only glob docs/*.md.

Frontend specs:
getEntraDeviceUrls() gained lapsUrl and loaded, but two siteSettings specs
still asserted the old two-key shape with toEqual, which is exact-match.
The implementation is correct - loaded is what lets a caller distinguish a
failed fetch from an unconfigured site, since both read as empty strings -
so the specs were brought up to the current shape rather than the return
value narrowed.

pinnedPanels.spec.js sliced 420 characters from getEntraDeviceUrls() and
asserted the finally block appeared inside it. Adding the retry logic
pushed finally past that offset, so a correct implementation reported as
"the finally is missing". Rebounded the slice to the function's own extent,
matching the structural approach already used elsewhere in this file for
the same reason. Verified by mutation: renaming the flag in the source
fails the test, which also caught that the spec reads
plugins/computers/frontend/views/PCDetail.vue and not the .plugins-staged
build copy.

tests/test_docs_publishable.py

@@ -94,7 +94,23 @@ def documentation_files():
 
 def test_there_are_docs_to_check():
     """A path change that silently matched nothing would make this suite pass
-    while checking absolutely nothing."""
+    while checking absolutely nothing.
+
+    FLAG FOR DOC AUTHORS: if this fails with a SMALL number (3, not 0), you have
+    almost certainly just committed a docs/*.md file. Don't lower the threshold
+    to make it pass - that is the exact failure this assertion exists to catch,
+    and it would silently disable the whole scrub suite.
+
+    docs/*.md prose is wiki-published and MUST stay untracked. The gates decide
+    'is this a published checkout?' by the ABSENCE of docs/*.md, so one tracked
+    prose file makes CI look internal while carrying no prose, and takes down
+    backend AND gates together. docs/DEV-BUILD-TEST.md and docs/PLUGIN-HOOKS.md
+    did exactly this and held the branch red for eight runs; both were untracked
+    (kept on disk) and .gitignore now ignores docs/*.md wholesale.
+
+    Authoring a doc is still fine - write it in docs/, it just stays local and
+    goes to the wiki. docs/notes/ and docs/openapi.json are unaffected.
+    """
     assert len(documentation_files()) > 20