docs: correct the "pi-studio has no bind flag" claim everywhere it was baked

1e4c238 fixed README; the same claim lived in three more places, all wrong
since pi-studio 0.9.60 added /studio --listen-all:

- rootfs/usr/local/bin/studio-expose header (and so its --help; the sed range
  grows 2,31p -> 2,35p so --help still ends at "runs it backgrounded.")
- pi-devbox-environment skill section 7: --listen-all as a third path, plus the
  0.10 whole-URL / 409 / "link looks damaged" notes, the published-port rule,
  --stop before --port, and the on-host curl 403-vs-empty-reply diagnostic
- Dockerfile.variant STUDIO_PORT comment

Bridge and --listen-all on one port: whichever starts second fails, measured
both ways on tor-ms22 (v1.11.2): Studio "listen EADDRINUSE ... 0.0.0.0:8765"
with the bridge up; studio-expose rc 1 on socat "bind(...): Address already in
use" with a 0.0.0.0 listener up. README's warning now says both directions.

Cost: studio-expose and the skill are in rootfs/, which base_tag hashes, so the
next release rebuilds the base (recomputed with the CI recipe: base-6f3b20266de1
at 1e4c238 -> base-26d425cea6c2 now). Noted in the CHANGELOG Unreleased entry.
No pin changes. lint-shell, dockerfile-directives and base-hash guards pass;
check-doc-drift is red only for the unrelated pi-extensions 750b2a8 -> 0d8e417.

CHANGELOG.md

@@ -13,18 +13,28 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ## Unreleased
 
-Docs only: this entry changes no pin.
+Docs and comments only: this entry changes no pin. Two of the files are
+baked into the base image (`rootfs/usr/local/bin/studio-expose` and the
+`pi-devbox-environment` skill), and `base_tag` hashes all of `rootfs/`, so
+**the next release rebuilds the base** rather than reusing
+`base-6f3b20266de1`.
 
 ### Fixed
 
 - **README "Using pi-studio" said pi-studio has no bind flag.** It has had
   `/studio --listen-all` (binds `0.0.0.0`) since pi-studio 0.9.60, so the
   section now lists it as path **C**, next to host networking (A) and the
-  `studio-expose` bridge (B). It also warns not to combine B and C on one port.
-  With `STUDIO_EXPOSE=1` the bridge holds the egress IP on `$STUDIO_PORT`
-  from boot, and `/studio --listen-all --port 8765` then fails with
-  `listen EADDRINUSE: address already in use 0.0.0.0:8765` (measured on
-  tor-ms22, v1.11.2).
+  `studio-expose` bridge (B). It also warns not to combine B and C on one
+  port, because whichever starts second fails. With `STUDIO_EXPOSE=1`,
+  `/studio --listen-all --port 8765` fails with
+  `listen EADDRINUSE: address already in use 0.0.0.0:8765`. In the other
+  order, `studio-expose` exits 1 on socat's `bind(…): Address already in
+  use` (both measured on tor-ms22, v1.11.2). The same stale "no bind
+  flag" claim is corrected in the three other places that carried it:
+  the `studio-expose` header (and so its `--help`, whose `sed` range
+  grows from `2,31p` to `2,35p`), §7 of the baked `pi-devbox-environment`
+  skill (which also gains the whole-URL, published-port and `curl` notes
+  below), and the `STUDIO_PORT` comment in `Dockerfile.variant`.
 - **The remote recipe described a pi-studio 0.9 URL.** Since 0.10 the printed
   URL carries `studioTabState` and `hostedWorkspace` as well as the token, and
   a token-only URL is answered `409`. The recipe now says to open the whole