plans: apply decisions on the open questions !478

Applies the decisions on the plans' open questions.

• ci-trust-and-build-reporting: a non-empty required-contexts list turns require-checks on; repo settings show prints both. #260: builds run with pasta:--no-map-gw, deploy/gitbay-runner-egress.nft limits ci-runner's traffic to the host to 127.0.0.1:22, loopback DNS and public 22/80/443; GITBAY_SSH is git@host[:port]; an sshd test pins the closed-registration lockout; the production throttle test is dropped from the runbook. Tree reuse for jobs naming no image is documented as a limit.
• data-at-rest-and-backup: offsite moves from Scaleway to Cloudflare R2 (bucket locks on data/, index/, snapshots/, keys/, config; scratch-bucket validation first; 30 nights in parallel). apns.p8 and secret.key go to a separate keys repository. The restore drill is deferred; #259 stays open after the code MR.
• cli-ux: the CLI sends the path it was invoked as (--path=); help and usage print gitbay auth keys remove … for the eighteen commands whose CLI path differs from the server path; a test pins that list.
• credentials-and-sessions, server-hardening: decisions recorded; pushes stay outside the pack limit; bay1's git (2.47.3) and relay STARTTLS checked.

Docs only.