Docs audit fixes: kiosk code drift, PowerShell chains, broken links, leaks

From the Fable/Opus documentation audit (8 confirmed + verified
lab-drift the run's session limit had cut short):
- HIGH: the lab's kiosk _kiosk_find_item block showed the pre-stage-17
  row-id resolver as current; replace with the shipped gagelabtag /
  numeric-tail resolver, fix the stale 'resolved by row id' prose and
  the 'stage-7 code is corrected' note.
- MED: the badge _external_lookup block used dict-only row access that
  breaks on a tuple cursor; use the tuple-or-dict form shipped. Split
  '&&' command chains (fail in PowerShell 5.1) in the lab.
- LOW/link: the Windows note's [DEVELOPMENT-SETUP] link dropped the .md
  and 404'd in four docs; fix. Correct the stage-6a->16a comment and
  the lab-stage tag range (..16 -> ..17).
- Leaks: drop /home/camp path from ADR-006, the internal gitea host
  from PLUGINS.md.
- Windows: add an mklink junction note for the external-plugin symlink
  dev loop.
- CI: prime root to mysql_native_password so pymysql connects to the
  MySQL 8 service without the cryptography package (and its kit wheel).

docs/PLUGINS.md

@@ -62,7 +62,7 @@ which revisions each plugin has applied in `migrations_applied`.
 
 For sister-site plugins (per [ADR-003](adr/ADR-003-plugin-distribution.md)):
 
-- Plugin lives in its own git repo: `gitea.proudtech.net/<your-site>/<pluginname>`
+- Plugin lives in its own git repo: `<git-host>/<your-site>/<pluginname>`
 - Adopting site clones or symlinks into their `<repo>/plugins/<name>/`
 - Plugin manifest declares `core_version` range matching the framework version they target
 - Plugin readme explains: what it tracks, who maintains it, where to file issues