v1.9.0: always protect docs/ and tests/ during a framework update

Framework updates now always protect a downstream's docs/ and tests/ trees.

- make servicepack-update adds docs/ and tests/ to the rsync's mechanical
  exclude floor, so an update can never overwrite a project's own docs or its
  test tree (the testcontainers harness plus its service tests). Previously only
  tests/ was protected, and only as an optional line each project had to copy
  into its .servicepackupdateignore by hand. A project that had not copied it
  would have its tests/testinfra overwritten by the framework's baseline.
- Removed the now-redundant tests/ opt-out from the shipped
  .servicepackupdateignore template. Pulling the framework's baseline test
  harness on update is no longer offered, because the floor always protects
  tests/.
- Updated the ownership docs (README layout, getting-started, framework-updates,
  development, and the agent skill) to state that docs/ and tests/ are yours and
  are never touched by an update.