docs: take two leaks off the public wiki, and say where the files come from

An ACCEPTED ADR ended with a stray tool-call fragment - it said nothing to a
reader and everything about how the document was produced, which is not what a
decision record is for. And the cutover playbook carried a real internal IP in a
file otherwise correctly scrubbed to documentation ranges. Both were published.

The publishability gate now catches all three shapes, so the next one fails a
build instead of reaching the wiki.

The adoption guide also told a site to copy two files that ship from nowhere:
the asset reporter and EventSaver are both on the reference site's imaging
share, not in this repository, and the guide never said so - it could not be
followed as written. It now states, per artifact, where each comes from, which
of them are pending a move into this repository, and that EventSaver can be
rebuilt from its one source file rather than taken on trust as a binary.

tests/test_docs_publishable.py

@@ -54,6 +54,12 @@ FORBIDDEN = [
     # nor meaningful to any other site reading these pages. Assembled from
     # fragments for the same reason as the terms above.
     ('tsg' + 'wp00525', 'names a production server'),
+    (r'\b' + r'172\.16\.' + r'\d', 'names an internal network'),
+    # A tool-call fragment reached the end of an ACCEPTED ADR and published to
+    # the wiki. It says nothing to a reader and everything about how the
+    # document was produced, which is not what a decision record is for.
+    ('</' + 'invoke>', 'contains a tool-call artifact'),
+    ('</' + 'content>', 'contains a tool-call artifact'),
     (r'\bwjs\.' + r'geaerospace\.net\b', 'names a site FQDN'),
     (r'10\.134\.48\.', 'names an internal network'),
     (r'10\.48\.249\.', 'names an internal network'),