docs(ci): the nightly does enable content freshness, as of 2026-08-26

The README's CI section still described the nightly toolchain step as
buying nothing: "which no nightly currently enables, so it is skipped and
the step is kept only against the day upstream restores it". That
sentence predates this branch and states as fact the exact reading the
rest of the PR retracts.

Three things in this PR falsify it. The corrected `env:` block at
README.md:110-117 records that since cargo PR #17382 (2026-08-22) the
`-Z` gate only unlocks the feature and `build.fingerprint` selects it, so
setting both turns it on. The corrected workflow comment in
.gitea/workflows/ci.yaml says "as of 2026-08-26 it does". And this
branch's own CI run printed `=== checksum-freshness mode: on ===` and
`hardlink-clone-selftest: 4 assertions passed` on 1.100.0-nightly
(787af2b8c 2026-08-25) — the scenario is not skipped, it runs.

The paragraph also carried no date, which is the failure mode every other
block this PR touched was rewritten to prevent. The replacement is dated
and names the toolchain, matching the corrected blocks elsewhere.

It deliberately stops short of "the scenario always runs": the suite
still settles the question by experiment on every run and still skips
loudly when it cannot measure, so the step is not unconditionally
exercised. Saying otherwise would trade one overclaim for its mirror.

Docs-only; no behaviour change.

README.md

@@ -558,11 +558,14 @@ bash scripts/selftest.sh --fast   # fixture-only suites, no compiler
 Both run in CI — `.gitea/workflows/ci.yaml`, one job, on pushes to `main` and
 on PRs that were non-draft when the run was created. It installs shellcheck
 and both a stable and a nightly Rust toolchain (nightly so
-`hardlink-clone-selftest.sh` can run its content-freshness scenario — which no
-nightly currently enables, so it is skipped and the step is kept only against
-the day upstream restores it) and references no credentials; the scratch
-workspaces the compiler-backed suites build use path dependencies only, so
-nothing reaches crates.io. It runs the full suite rather than `--fast`,
+`hardlink-clone-selftest.sh` can run its content-freshness scenario, which as
+of 2026-08-26 a nightly does enable — 1.100.0-nightly (787af2b8c 2026-08-25)
+resolves freshness by content given both `CARGO_UNSTABLE_CHECKSUM_FRESHNESS`
+and `CARGO_BUILD_FINGERPRINT: content`, per cargo PR #17382; the suite still
+settles that by experiment on every run and skips the scenario loudly when it
+cannot measure) and references no credentials; the scratch workspaces the
+compiler-backed suites build use path dependencies only, so nothing reaches
+crates.io. It runs the full suite rather than `--fast`,
 because the two compiler-backed suites are the ones that check this scheme
 against real Cargo instead of against a fixture. Draft (`WIP:`-titled) PRs
 skip it, and un-drafting does **not** un-skip them — the guard is evaluated