docs(contracts): state the offline limit of checkout removal

[rldyourmnd]

gds repository remove-checkout is documented as a working lifecycle, and it cannot run against any ordinary checkout.

Proving publication reads the remote ref. The mutation runner executes every Git command with protocol.allow=never and accepts only a locally resolvable URL, so a checkout whose origin is an ordinary https:// or ssh:// remote is refused with GDS_WORKSPACE_REMOVE_UNSAFE carrying the message "network Git mutation is disabled before the live provider stage". That is the runner's offline stance, not a property of the checkout, and the message names the runner rather than the cause — which cost a real retirement an hour of diagnosis today.

Materialization already carries its local-only caveat one paragraph above. Removal now carries its own, plus the evidence a device-local retirement has to gather instead: clean status, @{u} neither ahead nor behind, no stashes, no commits reachable only locally, and no tags the remote does not have. The last of those is not hypothetical — it caught two unpublished tags in a tree that every other check called clean.

ADR 0025 gains the price of its own accepted finding. Because the complete relationship index demands an anchor on every boundary under the analysed root, one unanchored external checkout makes gds repository delete unusable for the whole tree, not just for that checkout. The documented escape is narrowing --inventory-root, which is sound because the planner stores it as analysis_root and the apply path reuses exactly that value — so the narrowed scope is bound into the plan and into the approval that signs it.

Documentation only. Verification: scripts/validate_shell.sh exits 0, scripts/validate_go_core.sh --quick exits 0, and no generated state changed.

https://claude.ai/code/session_01CKXKXND4zAgWisTtatyTHX