docs(building): caveat sidecar availability in schemas-and-sdks.mdx tarball table

[bokelley]

Closes #3129

Summary

docs/building/schemas-and-sdks.mdx advertised .tgz.sig and .tgz.crt as unconditionally available for any {version}.tgz. They aren't — sidecars are produced only when the release was cut via the release.yml workflow (which runs npm run sign:protocol-tarball as part of npm run version). Out-of-band republishes bypass that workflow and produce no sidecars.

Three changes:

1. Table rows (lines 29-30): Add a one-sentence availability note to each sidecar row. The .crt row is now self-contained rather than cross-referencing .sig.
2. Column header: Renamed Stability → Notes; the new cell content answers "when is this URL populated?" not "is this URL stable?", so Stability was the wrong header.
3. Line 81 (checksum-only paragraph): Extended to cover out-of-band republishes alongside pre-signing releases.

Non-breaking justification: Docs-only prose edit. No schema, protocol spec, or code changes. Changeset uses --empty.

Pre-PR review

• code-reviewer: approved after blockers fixed — removed inaccurate "short deploy windows" phrase (signing is synchronous; real gap is out-of-band republishes only) and replaced imprecise "cosign step in release.yml" with accurate "when the release was cut via the release.yml workflow"
• docs-expert: approved after blockers fixed — renamed Stability column to Notes (semantic mismatch for availability content); made .crt row self-contained; trimmed "not yet propagated" from line 81 (signing commits .sig/.crt synchronously in the same version commit)

Session: https://claude.ai/code/session_01VdetT89tFwosLFikT2F92q

---

Generated by Claude Code