docs: record current TCFS workstream truth

[Jesssullivan]

Summary

• add a current TCFS workstream truth note for the July 6 daily-driver frontier
• point README wayfinding at the current note and state the no-heavy-neo-build rule
• tighten PZM lab acceptance preflight around TCC/PPPC/FDA, launchd/Nix/dyld contexts, SSD directory health, and password rotation

Validation

• git diff --check

Notes

This is intentionally separate from #534 so the keep-both PR-4 code gate does not restart remote CI.