docs(744): close the probe blockquote, and drop an overclaim it had just caveated

Self-review of the probe commit, on its own head. Two defects in it:

- The blockquote swallowed the start of the sentence that follows it, so
  'The cheapest way to avoid it entirely is' rendered inside the quote while its
  continuation rendered outside. Closed the quote and made the sentence stand alone.
- The decision record asserted the probe published the tag 'without moving :latest'.
  That is the exact overclaim the ci-cd.md probe note had just been careful to
  caveat: the rebuild was content-identical, so the observation is that :latest did
  not CHANGE, which cannot distinguish 'not pushed' from 'pushed the same digest'.
  The record now says :latest resolved to its pre-dispatch digest and points at the
  stated limit instead of restating a stronger claim than the evidence supports.

refs #744

Decisions-Edit: yes

docs/ci-cd.md

@@ -1817,9 +1817,11 @@ loop ersatztv#445 paid twice when `main` moved mid-review.
 > limit of that last check: `docker/ci` was unchanged, so the rebuild was content-identical and the
 > new `:<sha>` carries the same digest as `:latest`. It therefore shows `:latest` did not CHANGE, and
 > cannot by itself distinguish "not pushed" from "pushed the same digest" — the `refs/heads/main`
-> guard in the workflow is what makes that decision. The cheapest way to avoid it entirely is
-still to **land a toolchain-image change on its own, before** the work that consumes it, so the
-consuming branch never carries the `docker/ci` commit through a rebase.
+> guard in the workflow is what makes that decision.
+
+The cheapest way to avoid the rebase loop entirely is still to **land a toolchain-image change on its
+own, before** the work that consumes it, so the consuming branch never carries the `docker/ci` commit
+through a rebase.
 
 > **`docker/ci/**` has no cheap-edit path, comments included.** Editing any byte there re-points
 > `ci-image-pin`'s `expected` at the editing commit, so the five `container:` pins go stale and a

docs/decisions/records/ci/toolchain-image-publish-is-a-dispatch.md

@@ -33,8 +33,9 @@ mechanics: '`docs/ci-cd.md` -> "CI toolchain image" -> "Publishing from a branch
   `ci-image.yml` on that branch (it tags `git rev-parse --short HEAD`, so the two must coincide), then
   commit the pin bump on top. A rebase rewrites the sha, so all three are redone; that was already true.
   Probed rather than reasoned: dispatching on `fix/744-ci-image-branch-filter` at `43b1e45` succeeded
-  (run 2340), the job bound to that branch and sha, and it published `ersatztv-ci:43b1e45` without
-  moving `:latest` (2026-08-27, `docs/ci-cd.md`).
+  (run 2340), the job bound to that branch and sha, and it published `ersatztv-ci:43b1e45`; `:latest`
+  still resolved to its pre-dispatch digest, a check whose stated limit lives with the probe
+  (2026-08-27, `docs/ci-cd.md`).
 - **Dropping the self-path is a DECIDED TRADEOFF, and calling it forced would be wrong.** `ci-image-pin`
   derives `expected` from the last commit touching the image sources; while `.gitea/workflows/ci-image.yml`
   was one of them, editing that file re-pointed `expected` at the editing commit. Retaining it stays