docs: record live speech qualification and secure operator handoff

QUALIFICATION.md

@@ -9,8 +9,10 @@ Target: Unraid `192.168.86.2`, public UI `https://192.168.86.2:9178`.
 - Administrator container: `hope-hermes-admin-69101358`.
 - John Doe container: **`hope-hermes-john-doe-bac897a4`**, private and running.
 - User-facing test login username: `john-doe`. Initial passwords are generated,
-  not committed or printed; obtain them from the protected deployment credential
-  record or use administrator password reset in the website.
+  not committed or printed; initial `admin_password` / `john_password` are in
+  root-only `/mnt/user/appdata/hope-voice/bootstrap-credentials.json` (SSH),
+  or use administrator password reset in the website. This initial receipt
+  does not update after password resets.
 - Final voice image: `sha256:ea86ac10377c553f32a70d24f46dea1413c949673ed1b9850a4aabbe8574e8d8`;
   verified `healthy`. Final control HTTP health returned `{"status":"ok"}`.
 - No push performed. The existing dirty NAS checkout was not overwritten; clean
@@ -105,6 +107,11 @@ containers by timestamped name and root-only inspection receipt; rollback is
 installed before any stop/rename. Do not remove rollback containers or retained
 homes until explicitly deciding retention policy.
 
+Previously committed credentials (old CI and historical user registry) are no
+longer used/packaged. Source cleanup cannot erase Git history; rotate those old
+external credentials separately if they remain valid. The supplied new upstream
+credential stays protected runtime-only.
+
 No secrets belong in CI source; the workflow builds both images then calls the
 protected-host deployment script. LiveKit keys are runtime-only; committed YAML
 contains no usable key. Keep API origins synchronized for new DNS names.