chore(guides): live-verified guide-pool corrections (21 files)

[krls2020]

Guide content sync from ZCP (live-verified)

Updates 21 files in the guides/ content pool with platform-fact corrections — each live-verified against the real platform (eval-zcp) + the live import/zerops.yml JSON schemas, then reviewed by Codex (2 rounds). These guides feed ZCP's agent knowledge and llms-full.txt.

Note: environment-variables is a large hunk by design — see below.

Highest-impact corrections

• environment-variables (large hunk) — replaces the stale "cross-service vars auto-inject project-wide" model (legacy envIsolation=none) with the current default service isolation: siblings are isolated, reference them explicitly via ${hostname_var} in run.envVariables. Live-proven (a default project isolates siblings; explicit refs required). Also corrected: ${BUILD_x} (build var → runtime) does not resolve; PATH is hard-reserved (userDataUseOfSystemKey); a secret + yaml-baked var on the same key is rejected (userDataDuplicateKey); service hostnames are [a-z0-9] only (no dash→underscore case).
• deployment-lifecycle — a non-zero initCommands exit aborts the deploy (run.start never runs; the new appVersion is not activated). This is the opposite of the current per-runtime build-pipeline wording — live-confirmed twice (platform log RUN.INIT COMMANDS FINISHED WITH ERROR, empty /var/www, no process).
• choose-cache — Valkey is unauthenticated: redis://hostname:6379, no user/password vars (the prior ${user}:${password}@ connection string is fabricated).
• scaling — shared-storage accepts a verticalAutoscaling block; only object-storage rejects it.
• choose-runtime-base / zerops-yaml-advanced — only Deno is Ubuntu-only; Gleam runs on Alpine (alpine/gleam@* in the live schema). The switch-to-Ubuntu trigger is glibc/musl (CGO, C-extensions), not "needs a package".
• choose-database — managed DBs default to NON_HA (HA is opt-in); port 5433 is HA-only; the generated connectionString omits the /db path (append /${dbName} if your driver needs it).
• cdn — zsc cdn purge <domain> [path] (domain required first; Static-Mode CDN only).
• logging — zcli service log -S <id> (not a positional name) and --show-build-logs (kebab-case).
• ci-cd — pipeline skip needs the brackets: [ci skip] / [skip ci].
• smtp / production-checklist / metrics / php-tuning — fixed schema-invalid bare top-level envVariables: snippets (envVariables is valid only under build/run).
• vpn — --auto-disconnect disconnects an already-active VPN first (not "on terminal close").

Generated via zcp sync push guides.