docs(scripts): --after names the trigger's epoch, never a file mtime

Both drivers' help text recommended `--after "$(stat -c %Y <journal>)"`. Measured
2026-11-04 that epoch is answered by whatever scan finished before the question was
asked: on Jellyfin it reads an earlier task's EndTimeUtc, and the Plex door cannot be
a waiter at all, since PMS stamps section_locations.scanned_at when it accepts the
request. The laws are on the vault pages (main 146c28d); this puts the warning at
point of use, in the text an agent reads before calling the door.

scripts/media-refresh-plex.sh

@@ -23,7 +23,10 @@
 # Progress needs no token and no container: `section_locations.scanned_at` in
 # the library database is the same epoch the API prints as `scannedAt`
 # (verified 2026-11-04), so `status` reads the database and compares it against
-# --after. `trigger` answering 000 means PMS is still warming — retry, never
+# --after — which makes it a census of the last RECORDED scan, never a waiter: PMS
+# stamps that epoch when it accepts the request, so the door answers `settled` in the
+# same second its own `trigger` ran (measured 2026-11-04; no epoch survives it).
+# `trigger` answering 000 means PMS is still warming — retry, never
 # restart the service over it. Proof that a rename actually landed is
 # scripts/media-verify.py replaying the journal; this script only moves the
 # scanner along.