docs: take the Phase 1 exposure record private, leave a moved-note

463 lines with 64 mentions of specific hosts, in a public repo: the primary and
tunnel hosts by name, the registrar/DNS step, the tunnel resource wiring, shared
token custody, per-machine flip dates, and a palace lineage naming three work
machines. Now in the private fleet repo (fleet-ops 093fb65); this file becomes a
moved-note in the shape docs/synlig-primary-runbook.md already established.

Git history keeps the old text, so this limits future exposure rather than
undoing it.

Unlike the primary-host runbook, this file was MIXED — and the stub says so
instead of quietly implying the toolkit still documents HTTP exposure. §1.1-§1.3
(why one shared fleet token rather than per-device proxy users, and the one place
per-device identity does exist), §2 (the bind trap and the Host/Origin pin) and
§3.7 (a client is flipped by three env vars that travel as a set) are reusable
mechanism now published nowhere else. Named in the stub so the extraction is
tracked debt rather than a silent loss, and named in the private copy too so
whoever extracts it can delete the duplicate.

Inbound references fixed rather than left pointing at content that moved: two
§3.8 pointers in extensions/pi/README.md are replaced by the instruction they
were pointing at (the palace path reported by mempalace_status must be the
remote host's — a half-flipped client looks healthy while reporting a local
path), and the bind-trap reference is replaced by the Host/Origin sentence
itself, so the extension README no longer depends on the moved file. contrib
also loses a hostname and a seeding date it did not need to make its point.

extensions/pi/README.md

@@ -187,8 +187,8 @@ chosen at load time:
   transport is chosen once at extension load. Confirm the result the same way
   as a container flip: ask the agent for `mempalace_status` and check the
   reported palace path is the **remote** host's, not your own
-  `$HOME/.mempalace/palace` — see
-  [`docs/phase-1-exposure-runbook.md`](../../docs/phase-1-exposure-runbook.md) §3.8.
+  `$HOME/.mempalace/palace`. That one check is the whole verification: a
+  half-flipped client reports a local path while looking healthy.
 
   Serve such an endpoint with `mempalace serve --host 172.17.0.1 --port 8765`
   (the `pi-devbox` / `opencode-devbox` repos ship a
@@ -207,8 +207,9 @@ chosen at load time:
   token auto-minting is gated on the bind being non-loopback, so it starts with
   **no authentication at all**, no warning. Bind the docker0 gateway
   (`172.17.0.1`): reachable from the host and its containers, not from the LAN.
-  See
-  [`docs/phase-1-exposure-runbook.md`](../../docs/phase-1-exposure-runbook.md).
+  Binding an interface is not the same as exposing a palace — an MCP endpoint
+  also pins `Host`/`Origin`, so a request arriving under the wrong hostname is
+  refused even when the port is open.
 
   Implementation note: the HTTP client (`RemoteMcpClient`) is **vendored** from
   [`pi-extensions`](https://gitea.jordbo.se/joakimp/pi-extensions)'
@@ -234,9 +235,9 @@ local palace, so a remote outage can never scatter memories into a local copy
 nobody will look at again. The practical corollary, worth knowing before you
 debug the wrong layer: **"the agent has no `mempalace_*` tools" is the
 expected symptom of a server, token, or DNS fault**, not of a broken install.
-Diagnose it with a direct `curl` to `MEMPALACE_REMOTE_URL` — see
-[`docs/phase-1-exposure-runbook.md`](../../docs/phase-1-exposure-runbook.md)
-§3.8. The design rationale for de-registering rather than degrading is in
+Diagnose it with a direct `curl` to `MEMPALACE_REMOTE_URL`, and confirm the flip
+with `mempalace_status` — the reported palace path must be the remote host's.
+The design rationale for de-registering rather than degrading is in
 [`docs/rfc-001-global-palace.md`](../../docs/rfc-001-global-palace.md) §2 and §4.1.
 
 ## Identity