docs(445): fix dangling decision key + clarify UI-E2E step reference [decisions-edit]

Two review findings from the cold docs/convention pass.

HIGH — the new `ci.ui-e2e-harness` record cited `` `ci.toolchain-image` `` as if
it were a resolvable decision key. No such key exists anywhere in the corpus
(verified: the only occurrence in all of docs/ was that citation itself). #390's
toolchain-image work was deliberately never migrated to a standalone record —
`ci.runner-placement`'s own Signals line says so.

This is exactly the breadcrumb hazard docs/README.md -> "Knowledge retrieval"
warns about: a future session (or a MemPalace lookup) resolving that key gets
nothing back, and cannot distinguish "retired" from "never existed". Replaced
with an explicit pointer to #390, `ci.runner-placement`, and docs/ci-cd.md, and
stated outright that #390 has no standalone record.

Swept the whole class rather than the one instance: every dotted key cited in
added lines across the diff now resolves (ci.functional-e2e-harness,
ci.runner-placement, ci.ui-e2e-harness).

NIT — docs/ci-cd.md said the UI-E2E step is "Step 4 of this same job", which
refers to the doc's own 4-item prose summary, not the YAML step list (where it
is the 11th `steps:` entry). Reworded to name the actual step so a reader
skimming the workflow isn't sent looking for a 4th YAML step.

Refs #445

docs/ci-cd.md

@@ -439,7 +439,8 @@ same staged rollout the `migrations` job used. SQLite is the default provider, s
 it needs **no** DB service container. Runs on PRs and on `main` (regression net); skipped for `v*` tag
 builds. The playout-build lock 409 + `isLocked` projection (#215) landed in #444.
 
-**UI-E2E step (ersatztv#445).** Step 4 of this same job runs the headless-browser flows the curl
+**UI-E2E step (ersatztv#445).** The last step of this same job (item 4 in the summary above; the
+`Run UI-E2E Playwright flows (headless)` entry in the YAML) runs the headless-browser flows the curl
 harness structurally cannot express — client-side form validation, `AuthGate`'s rendered states, the
 session cookie authenticating the **SPA's own** `/api` XHRs, and sign-out via the `UserMenu`:
 

docs/decisions.md

@@ -3686,7 +3686,8 @@ that test.
 
 **Baked browser, not a per-run install.** `chromium-headless-shell` is installed into
 `/ms-playwright` at image build time, so the job installs nothing — the same "jobs install nothing at
-run time" rule as the rest of the toolchain image (`ci.toolchain-image` lineage, #390). Measured on the
+run time" rule as the rest of the shared CI toolchain image (#390, which has no standalone decision
+record — see `ci.runner-placement` and `docs/ci-cd.md` -> "CI toolchain image"). Measured on the
 real base: the headless shell is **267M** where full `chromium` is **656M**, and `chromium.launch()`
 resolves to the shell anyway because the config never asks for headed. The accepted tradeoff is that a
 *headed* run inside the image would fail; that is CI-only, and a developer running headed uses their own