fix legend blurbs missed by hardening (SCC UID-range, MachineConfig SSH, readiness) + extend preflight to scan the app JS where legends inline

pilot/manifest-orbit.json

@@ -119,7 +119,7 @@
   {
    "name": "scc",
    "title": "SCC",
-   "blurb": "Admission: what a pod may BE. restricted-v2 runs you as a random non-root UID - your image has to cope.",
+   "blurb": "Admission: what a pod may BE. Under the restricted SCCs a workload runs as a non-root UID from the project's allocated range, so the image must cope with an arbitrary UID.",
    "z": 0,
    "points": [
     [
@@ -607,7 +607,7 @@
   {
    "name": "machineconfig",
    "title": "MachineConfig",
-   "blurb": "The OS underneath is immutable - changed by declaration, never by SSH.",
+   "blurb": "Node OS configuration goes through MachineConfig declaratively; ad-hoc SSH changes create drift and are not the intended model.",
    "z": 0,
    "points": [
     [