docs: move the branch warning into a TOOLING.md that main does not have

Putting it at the top of README.md worked, but it diverged a shared file: a
probe showed main editing the adjacent line conflicts on every merge. The
warning survived the conflict, so nothing was ever silently lost, but a file
that only exists on this branch has no such cost at all.

TOOLING.md carries the warning plus what CLAUDE.md would have said if it could
— the commands, the remote policy, and the two guards, which are local and
unversioned and so are absent from every fresh clone.

Shared files are byte-identical to main again: CLAUDE.md, README.md and
package.json. The divergence is now only files main has never had.

Trade-off worth knowing: gitea renders README.md on the branch page and does
not render TOOLING.md, so this warning is one click less visible than it was.
The pre-push hook, not the documentation, remains the guard that actually
stops a mistake.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UXfdJu7QhSJLr47K7koTDF

README.md

@@ -1,37 +1,5 @@
 # InstaArchive Viewer
 
-> [!CAUTION]
-> ## This branch must not be published to GitHub
->
-> You are on **`tooling`**. It is the only branch that still contains the
-> archive-fetching scripts and their docs, and those name things `main` was
-> rewritten to remove:
->
-> - the fetch host's **public IP** (`docs/gallery-dl.md`)
-> - the browser profile the session cookie is read from
-> - the NAS archive path
-> - the **list of Instagram accounts being archived**
->
-> On 2026-08-20 `main`'s entire history was rewritten with `git filter-repo`,
-> the GitHub repo was deleted and recreated, and 22 container images were
-> pruned from ghcr — all to remove exactly this material from public view.
-> **One push of this branch to GitHub undoes all of it**, and the second
-> cleanup would be harder than the first: force-push residue stayed reachable
-> by SHA until the repo itself was deleted.
->
-> Guards in place, neither of them foolproof:
->
-> - `.git/hooks/pre-push` rejects any ref but `main`/tags to the GitHub remote.
->   It is **local and unversioned** — a fresh clone does not have it.
-> - `git config remote.github.push refs/heads/main:refs/heads/main`.
->
-> Recreate both after cloning. `origin` is gitea and is the right default for
-> everything; GitHub only ever needs `main` and the current release tag.
->
-> *This block exists only on `tooling`. If a merge from `main` ever conflicts
-> here, keep both sides — the warning is not something `main` deleted.*
-
-
 A high-performance React PWA for browsing archived Instagram data with a native-feeling interface. Supports both official Instagram exports and Instaloader archives.
 
 ## Features