Document external history copies

[Codewriter90x]

What changed

• narrows the withdrawal claim to the current tree, maintainer-controlled
  branches/tags and affected release assets;
• discloses that GitHub pull-request refs, caches, local clones and two
  third-party forks can retain copies outside maintainer control;
• adds the same boundary to the generated Sources page and v2.0.0 notes.

Why

A post-rewrite audit confirmed that all controlled public branches and tags
are clean, but historical pull-request refs and third-party forks remain
reachable. The public documentation must not imply those external copies were
purged.

Validation

• Ruff;
• mypy;
• five Pages tests;
• deterministic Pages build;
• validation of 8,030 HTML pages and payload budgets;
• git diff --check.