Give the runbook the new-table case, and separate the two rebuilds

[kengio]

Follow-up to #7, which added rebuild to the master workflow and documented the skip in modes.md. The reference docs now describe the behaviour; the runbook — where an operator actually goes when something looks wrong — still did not.

The case that was missing

An estate using a table glob meets this before any other: a table created since the last generate is not granted, and every run since has reported success. Nothing in the runbook explained that.

New 3i covers:

• why the skip holds — config_hash fingerprints config rows and cannot see the catalog
• that it is intended: a table arriving in storage is not by itself a decision to share it
• rebuild=True re-resolves every pattern, so it takes in every table added since the last real generate, not only the one you had in mind — read the plan, not the config diff
• holding one back with exclude_tables, and that a zero-match exclude is an error (rule A2), so the table must already exist
• the stale converse: a deleted table stays in the mapping, and apply keeps submitting a role naming a path that is gone
• the unrelated conditions (member pattern, drifted objectIds, target mismatch, member-table errors, framework-version change) that force a full re-resolution and therefore widen scope as a side effect — a run made for one of those reasons can grant new tables with no config edit behind it

The sharper problem: one word, two opposite meanings

rebuild appeared in the runbook in exactly one place — 3e, setup(rebuild=True), which DROPS a control table and loses its data.

So an operator whose new table is missing, searching the runbook for rebuild, found the destructive one and no sign that a harmless one exists. 3e now states that the two share a parameter name and nothing else, and points at 3i.

Safety language

Both sections say plainly that not granting a table is not denying it — readability still depends on workspace and item permissions and the access path, so a missing grant must not be read as containment. This matches the framing modes.md and architecture.md already use.

Verification

• check_public_release.py tree . — PASS, 0 findings
• check_external_links.py — 40/40 reachable
• docs-only: no runtime change, no version bump, no tag. CHANGELOG under [Unreleased].