blog: refine incident timeline + all-clear banner; smoke: stabilize via TANSTACK_DOCS_USE_REMOTE

[tannerlinsley]

Summary

• Postmortem (npm-supply-chain-compromise-postmortem.md): corrected the timeline using verified GitHub/npm/shell-history timestamps. Key corrections: PR #7369 was merged 2026-05-09 (the 19:15 UTC May 11 event was a workflow re-run, not a fresh merge); StepSecurity issue opened at 19:46:46 UTC; deprecation actually ran in three phases at 20:19 / 20:41 / 21:03 UTC (not a single ~21:00 batch); the npm-side tarball removal window 22:13–23:55 UTC was reattributed to npm acting on the StepSecurity notification; formal IOC email to npm/GitHub Security went out at 05:02 UTC May 12 (not ~20:30 UTC May 11). Added a Response timing table, an all-clear status banner, a link to the companion followup, and a Changelog section.
• Followup (incident-followup.md): corrected package count (14 → 42) and registry-exposure window ("about 20 min" → "20 to 26 min") to match verified data. Added the all-clear status banner and a Changelog section.
• Smoke tests (tests/smoke.ts): docs routes were flaky in worktrees because ../../../../{repo} sibling resolution doesn't reach ~/GitHub/{repo} from inside .claude/worktrees/. Smoke now probes the existing dev server's docs route, and if it can't serve them, spawns its own dev server with TANSTACK_DOCS_USE_REMOTE=1 so docs lookups fetch from raw.githubusercontent.com via the existing fork point in shouldUseLocalDocsFiles().

Test plan

• All 10 smoke tests pass locally (home, blog index, blog post, ethos, query/router/table docs, 3 OG images)
• Pre-commit hooks pass (format, content:build, tsc, lint, smoke)
• Visually verify both blog posts render correctly in the live preview after deploy