docs: fix reference/workflows.md opening snippet to match the shim model

[coretl]

Summary

• Fixes three errors in the reference/workflows.md opening snippet that would cause silent failures for first-time adopters copying it:
  • uses: …/publish.yml@<tag> → uses: ./.github/workflows/publish-dispatch.yml — publish.yml is workflow_call-only; the re-dispatch re-fires the shim by name, so a consumer calling publish.yml directly gets no tag re-deploy
  • actions: read → actions: write — the re-dispatch job runs gh workflow run, which requires write
  • if: <internal-event + canonical-repo guard> → if: github.repository == 'ORG/REPO' — the fork-warn branch lives inside publish.yml, not in the caller
• Clarifies the opening prose to note that publish.yml is reached via the local shim, not directly

Closes #34 (the "Before you start" docs were already fixed on the refactor-gather-priority branch, now merged).

Test plan

• Check the rendered reference page matches the tutorial's ci.yml snippet