[codex] reshape onboarding tutorials

[jeremi]

Summary

This PR reshapes the Registry Stack onboarding ladder around a smaller Supabase-style local flow:

• expands the generated registryctl sample into a three-table benefits workbook and aligns Relay config, smoke checks, Bruno generation, and generated READMEs with that model
• rewrites the first two core tutorials around running a protected local API and evaluating a claim with Notary
• reframes standalone Notary as a Registry Data API-specific path, with custom HTTP/FHIR/DHIS2/OpenCRVS sources routed through source-adapter or named integration tutorials
• adds a separate DHIS2 claim-check tutorial and removes the embedded DHIS2 flow from See it live
• cleans public docs language so OpenFn is no longer presented as the current source-adapter lane; remaining openfn references are marked as legacy runtime/CLI names where the lab still requires them

Validation

• cargo fmt --all --check
• cargo test -p registryctl --locked
• npm ci --ignore-scripts
• npm run generate
• npm run check:content
• npm run check:markdown
• npm run check:tutorial:dry-run
• npm run check:config-vocabulary
• npm run check:docset
• npm run build
• npm run check:openapi (passed with existing OpenAPI lint warnings)
• npm run check:llms:built
• npm run check:svg
• npm run check:links:built
• git diff --cached --check

Known follow-ups / risks

• The DHIS2 tutorial still preserves literal legacy lab names such as OPENFN_*, openfn-dhis2-sidecar, and output/dhis2-openfn/ because renaming runnable lab artifacts is a separate cleanup.
• npm run check:style, npm run check:style:fixtures, and npm run build:archives were not completed because Vale/archive generation hung in this environment. npm run check:seo:built was not counted as passed because archived HTML was not built.
• The full npm run check was not completed due to those Vale/archive blockers.