PROMPT-TEMPLATE: defer is graceful-exit-only, not crash-safety

The crash-safety checklist listed "guaranteed cleanup via defer" alongside real
crash-safety primitives, which reads as though defer covers a crash. It does not:
a defer does not run on SIGKILL. Campaign 8 fault 10 proved this on live hardware.

Crash-safe cleanup needs an on-disk marker plus a startup Recover(); defer covers
graceful exits only. Both are useful, they are not substitutes.

documentation/PROMPT-TEMPLATE.md

@@ -279,7 +279,9 @@ Then:  [exact refusal — HTTP status, error, and the proven non-effect, e.g. "m
 **DO:** [explicit positive instructions; tricky code snippets only — CC fills the obvious parts]
 **DO NOT:** [the specific anti-pattern for THIS task]
 **Crash-safety (if stateful):** journal-before-mutate; atomic tmp+fsync+rename; `Recover` on startup;
-guaranteed cleanup via `defer`; single-flight mutex; `ListLXC`-style ground truth in recovery.
+guaranteed cleanup via `defer` **for graceful exits only** — a `defer` does NOT run on SIGKILL, so a
+crash-safe cleanup needs an on-disk marker plus a startup `Recover()` (Campaign 8 fault 10 proved
+this on live hardware); single-flight mutex; `ListLXC`-style ground truth in recovery.
 
 **Green gate:** `go build ./... && go vet ./... && go test ./internal/<pkg>/`