docs(60): point-of-use corrections from the 2026-10-20 review

Measured fixes, one line each, from the review of everything that landed on
2026-10-20 (issue #60). Each page keeps its own facts; nothing was moved.

- inventory/index, index: the census blurb says what the page actually covers
  (tracked-vs-box-only per file), not "all userspace configuration"
- dotfiles-deploy: the wallpaper re-fetch recipe resolves the CDN URL through
  the wallhaven API — /w/<id> answers text/html, so curl -L never yields a
  JPEG; description widened to the whole page, tools/index blurb matched
- okf-maintenance: the link example and the mistake bullet now agree with
  okf-spec, which RECOMMENDS absolute bundle paths (they said the opposite)
- decisions/index: the unlisted-page gate is kb-coverage.py, not kb-lint
- AGENTS.md: the three skill-config subsections are pointers again; the pages
  own issue tracker, labels and domain docs
- swayidle-lock.service: Description names what the unit does (arms the idle
  lock over noctalia-shell IPC); suspend belongs to noctalia's inhibitor
- common.pkgs: git-lfs re-justified by the tracked .gitattributes filter
  contract; the swayidle comment drops its lid-policy claim

omp-docs/tools/dotfiles-deploy.md

@@ -1,14 +1,14 @@
 ---
 type: reference
 title: Dotfiles deployment tier
-description: How dotfiles/ packages become live configuration — stow-equivalent symlinks, host override packages, and the two laws about theme media and systemd enable symlinks.
+description: How dotfiles/ packages become live configuration — deploy.sh modes, host override packages, and the tier's hard-won laws, from media and generated theme output to systemd enable/start semantics, dconf dumps, and idle-lock watcher triage.
 tags:
   - dotfiles
   - deployment
   - systemd
   - noctalia
 timestamp: 2026-10-20
-verified: 2026-10-20
+verified: 2026-10-21
 ---
 
 # Dotfiles deployment tier
@@ -54,8 +54,17 @@ checkout, `git rm --cached` on the branch notwithstanding.
 
 Restore on a fresh box: the library lives in `~/.local/share/noctalia/wallpapers/`, a path
 `deploy.sh` does not manage. Every filename is `wallhaven_<id>.<ext>` and the ID is the
-whole address — `curl -L -o <name> "https://wallhaven.cc/w/<id>"` into that directory puts
-the set back. Losing it is an acceptable outcome; 80 MB per clone forever is not.
+whole address — but `https://wallhaven.cc/w/<id>` answers `text/html`, the web page, so
+resolve the direct CDN URL through the API and download that:
+
+```bash
+id=73g8xo   # the wallhaven_<id> stem of any file in the set
+url=$(curl -s "https://wallhaven.cc/api/v1/w/$id" | grep -o '"path":"[^"]*' | cut -d'"' -f4)
+curl -L -o ~/.local/share/noctalia/wallpapers/"${url##*/}" "$url"
+```
+
+`data.path` already ends in `wallhaven_<id>.<ext>`, so the filename keeps itself. Losing it
+is an acceptable outcome; 80 MB per clone forever is not.
 
 ## Law: never `systemctl --user enable` a unit from a worktree