docs: focus public documentation on product usage

docs/install/authentication-oidc.md

@@ -71,7 +71,7 @@ The surfaces have distinct semantics and this order is recommended:
    issuer/JWKS, catalog credentials, and all configured mapped groups.
 3. `tht auth check --interactive` repeats live diagnosis and additionally validates a device-flow
    identity and its direct `groups` claim when Device Authorization is available.
-4. Workspace Test performs aggregate live workspace and authentication validation.
+4. Installation diagnostics perform aggregate live workspace and authentication validation.
 
 The live CLI forms are:
 
@@ -87,8 +87,8 @@ real ID token including `groups`. It is an operator check, not a replacement for
 `tht doctor` emits this exact ordered report: `descriptor`, `files`, `docker`, `compose`,
 `configuration`, `authentication`, `services`, `core-http`, `frontend-http`,
 `workspace-registry`, `workflow`, `pi`. Its authentication entry is live and non-interactive.
-Any authentication failure makes Workspace Validate or Workspace Test non-activatable according
-to that surface's static or live scope.
+Any authentication failure prevents activation according to the static or live scope of the
+relevant diagnostic surface.
 
 The complete closed diagnostic-code union and exact role-to-permission expansion are in the
 [authentication architecture](../architecture/authentication.md).