docs: describe read-only workspace runtime configuration

frontend/src/shell/WorkspaceManager.test.tsx

@@ -99,7 +99,8 @@ test("level one explains the read-only Git sequence and the repository update bu
 
   await user.click(screen.getByRole("button", { name: "Update workspace repository" }));
   expect(await screen.findByText("Workspace repository updated and validated.")).toBeVisible();
-  expect(screen.queryByText(/import|export|bundle|create a local workspace/i)).not.toBeInTheDocument();
+  expect(screen.getByText(/create a local workspace/i)).toBeInTheDocument();
+  expect(screen.queryByText(/import|export|bundle/i)).not.toBeInTheDocument();
 });
 
 test("workspace-specific commands remain isolated until a workspace is selected", async () => {

frontend/src/shell/WorkspaceManager.tsx

@@ -274,7 +274,7 @@ export function WorkspaceManager({ open, onClose }: { open: boolean; onClose: ()
                   <h2 className="font-heading text-xl font-semibold">How workspaces reach ThothII</h2>
                 </div>
                 <ol className="grid list-decimal gap-3 pl-5 text-sm leading-6 text-muted-foreground">
-                  <li>Prepare the workspace source in its own directory. It must contain <code>workspace.yaml</code> and every required subdirectory, including any versioned Evidence files.</li>
+                  <li><span className="font-medium text-foreground">Create a local workspace</span> in its own source directory. It must contain <code>workspace.yaml</code> and every required subdirectory, including any versioned Evidence files.</li>
                   <li>Publish that source by committing and pushing it to a repository hosted by a Git server such as GitHub, GitLab, or Gitea.</li>
                   <li>The repository address, branch, and read-only Git credentials are configured during ThothII installation. This installation reads <span className="font-medium text-foreground">{repositoryLabel}</span> on branch <span className="font-mono text-foreground">{statusQuery.data?.branch ?? "main"}</span>.</li>
                   <li>ThothII fetches the configured branch into its managed read-only checkout, validates the complete candidate revision, and activates it only when validation succeeds. It never edits, commits, pushes, or publishes workspace source.</li>