docs: define strict dry-run contract

# Conflicts:
#	.secrets.baseline

tests/integration/test_pipeline_runner.py

@@ -505,7 +505,6 @@ def test_from_settings_configures_source_state_persistence_for_dry_run(
     import pronote_sync.pipeline.run as run_module
 
     blog_persistence: list[bool] = []
-    auth_persistence: list[bool] = []
 
     class RecordingBlogState:
         """Blog state factory recording its persistence configuration."""
@@ -517,16 +516,6 @@ def test_from_settings_configures_source_state_persistence_for_dry_run(
             """
             blog_persistence.append(persistence_enabled)
 
-    class RecordingAuthState:
-        """Authentication state factory recording its persistence configuration."""
-
-        def __init__(self, *, persistence_enabled: bool = True) -> None:
-            """Record the requested persistence setting.
-
-            :param persistence_enabled: Whether disk writes are enabled.
-            """
-            auth_persistence.append(persistence_enabled)
-
     class RecordingClient:
         """Pronote client constructor accepting the injected auth state."""
 
@@ -539,19 +528,16 @@ def test_from_settings_configures_source_state_persistence_for_dry_run(
             del settings, auth_state
 
     monkeypatch.setattr(run_module, "BlogRSSState", RecordingBlogState)
-    monkeypatch.setattr(run_module, "PronoteAuthState", RecordingAuthState)
     monkeypatch.setattr(run_module, "PronoteClient", RecordingClient)
 
     PipelineRunner.from_settings(
         Settings(
             app=AppSettings(dry_run=dry_run),
             blog=BlogSettings(enabled=True),
-            pronote=PronoteSettings(auth_mode="qr_token"),
         )
     )
 
     assert blog_persistence == [not dry_run]
-    assert auth_persistence == [not dry_run]
 
 
 def test_runner_reuses_ical_download_and_parse_within_one_run(