docs: correct Pi operator recovery guidance

scripts/verify-workspace-install-docs.sh

@@ -1153,6 +1153,8 @@ verify_pi_management_guide() {
     "restart only core" \
     "deploy/pi/models.json" \
     "deploy/pi/settings.json" \
+    "policy only" \
+    "backend installation settings" \
     "PI_AUTH_FILE" \
     "pi update" \
     "pi rollback --yes" \
@@ -1160,13 +1162,15 @@ verify_pi_management_guide() {
     "pi maintenance recover --yes" \
     "pi logs" \
     "/run/secrets" \
-    "Raw Compose access is unsupported" \
-    "no browser shell" \
-    "does not mount the Docker socket"
+    "Raw Compose access is unsupported"
   if grep -Fq '~/.pi/agent/' "$guide"; then
     echo "Pi management guide must not direct ThothII operators to native Pi paths" >&2
     return 1
   fi
+  if grep -Eqi 'browser shell|host-native Pi|host Pi|running container|live container' "$guide"; then
+    echo "Pi management guide must not include native-Pi, browser-shell, or live-container workflow" >&2
+    return 1
+  fi
   node - "$guide" <<'NODE'
 const fs = require("fs");
 const source = fs.readFileSync(process.argv[2], "utf8");