Close Public Preview review gaps

[tensornull]

Summary

• replace stale first-push instructions with the remaining pre-visibility gate
• document the alpha.1-only npm bootstrap and executable cometapi-team owner verification
• cover the standalone live-smoke reviewer contract and references private-material rule

Why

This closes the final documentation and regression-test findings from the review of 1f69eed through 27f12da without changing repository visibility or exercising public-only configuration.

Verification

• npm run verify
• 99 tests passed in both the repository and standalone-copy runs
• Public Preview, secret, package, fixture, compatibility, actionlint, and self-contained gates passed