docs: purge stale lamassu naming; fix the hal-check skill's provenance boundary

- @lamassu/clink import examples → @bitSpire/clink, the package's real name.
- machine-installation.md: the service user is `bitspire`, not `lamassu`
  (renamed in configuration.nix long ago; the doc never followed).
- README: clone aiolabs/bitspire, not lamassu-next; the fleet sentence
  claiming batm3/douro run `main` against Lightning.Pub was stale.
- nostr-check skill: table headers say bitSpire.
- hal-check skill: the boundary is c0b69d1, not v8.1.5 (CLAUDE.md corrected
  this 2026-07-04; the skill kept asserting the wrong tag), and the
  "forbidden operations" now reflect the recorded permission —
  reference over port, name the source commit — plus a rule born of the
  GTQ window: no value table without a test over it.

Deliberately kept: every `aiolabs/lamassu-next#NN` issue citation, the
provenance sections, "Ported from lamassu-machine" driver headers, and
the hardware names "Lamassu Sintra/Tejo/Douro" — those are the machines.

docs/ndebit-cash-in-flow.md

@@ -139,7 +139,7 @@ export const NDEBIT_REGEX = new RegExp(
 
 ```typescript
 // In lib/types/parse.ts
-import type { DebitPointer } from '@lamassu/clink'
+import type { DebitPointer } from '@bitSpire/clink'
 import type { Satoshi } from './units'
 
 export enum InputClassification {
@@ -159,7 +159,7 @@ export interface ParsedNdebitInput {
 
 ```typescript
 // In lib/parse.ts
-import { decodeNdebit } from '@lamassu/clink'
+import { decodeNdebit } from '@bitSpire/clink'
 
 // Add to VALIDATORS array:
 {
@@ -209,7 +209,7 @@ case InputClassification.NDEBIT: {
 ```typescript
 // In State/scoped/backups/sources/history/claimNdebitThunk.ts
 import { getNostrClient } from '@/Api/nostr'
-// Note: SendNdebitRequest is wallet-side code, not part of @lamassu/clink
+// Note: SendNdebitRequest is wallet-side code, not part of @bitSpire/clink
 // This example shows the wallet's implementation pattern
 import { finalizeEvent } from 'nostr-tools'
 import { SimplePool } from 'nostr-tools'
@@ -849,7 +849,7 @@ See "Single-Use Protection" section above for implementation details.
 
 ```json
 {
-  "@lamassu/clink": "workspace:*",
+  "@bitSpire/clink": "workspace:*",
   "nostr-tools": "^2.x.x",
   "@noble/hashes": "^1.x.x",
   "qrcode": "^1.x.x"