Follow up install-smoke/release-security validator clarity warnings

[aram-devdocs]

Follow-up from PR #200 Claude APPROVE warnings:

• Document install-smoke validator matrix count expectations (cargo_count=3, curl_count=3, brew_count=2, npm_count=3).
• Rename misleading npm pass message from "stays limited" to reflect all three gated OS legs.
• Normalize/comment absent-file behavior for new dist-workspace.toml checks in tests/release-security-validate.sh.

Non-blocking for PR #200; created to satisfy the warning follow-up gate.

[aram-devdocs]

Closed by PR #217 (Phase 2 polish bundle merged).