docs(phase5c): enrollment communications documentation + Google Workspace runbook

- PHASE5C_ENROLLMENT_COMMUNICATIONS.md: the full design doc.
- RUNBOOK_GOOGLE_WORKSPACE_EMAIL.md: every REQUIRES GOOGLE WORKSPACE ADMIN ACTION step
  (mailbox, service account, domain-wide delegation scoped to gmail.send only, SPF/DKIM/DMARC),
  environment variables, testing procedure, production secret handling, rotation, revocation,
  troubleshooting, quotas.
- RUNBOOK_STUDENT_ACTIVATION.md: day-to-day operation of the pipeline from /admin.
- WEBSITE_ENROLLMENT_INTEGRATION.md: explicit website-vs-RootNode responsibility boundary,
  the new contact_email field, and closes the 'RootNode doesn't send activation email yet'
  known limitation this doc previously documented.
- RUNBOOK_SELF_PACED_ENROLLMENT.md, RUNBOOK_STUDENT_ACCOUNT_LIFECYCLE.md: point at the new
  automatic-email behavior and the Resend activation control.
- REMOTE_AND_SELF_PACED_ARCHITECTURE.md, ENGINEERING_SOP.md: close the enrollment-
  communication gap; new ENGINEERING_SOP §16.
- PRODUCTION_VALIDATION_CHECKLIST.md, README.md, platform/README.md: cross-references and a
  Phase 5C production-validation section.

docs/RUNBOOK_STUDENT_ACCOUNT_LIFECYCLE.md

@@ -1,15 +1,20 @@
 # Runbook: Student Account Lifecycle
 
 Covers creating, converting, resetting, and revoking student accounts. See
-`docs/PHASE5A_STUDENT_IDENTITY_REMOTE_CLASSROOM.md` for the underlying design.
+`docs/PHASE5A_STUDENT_IDENTITY_REMOTE_CLASSROOM.md` for the underlying design and
+`docs/PHASE5C_ENROLLMENT_COMMUNICATIONS.md`/`docs/RUNBOOK_STUDENT_ACTIVATION.md` for the
+automatic-email side of this, added in Phase 5C.
 
 **Create a new credentialed student** (`/admin` → Students → Add student):
 
 Fill in display name plus **either** email (older/self-paced) or login ID (younger/instructor-
 managed) — leave both blank for a plain pilot account instead. Submitting shows an activation
-link **once**: `https://<domain>/?activate=<token>`. Copy it immediately (print it, read it
-aloud, hand it over) — it is never shown again and never stored in plaintext anywhere. The
-student opens the link and sets their own password; the instructor never sees it.
+link **once**: `https://<domain>/?activate=<token>`. As of Phase 5C, if the student has an
+email, RootNode also sends it to them automatically — the on-screen link remains a manual-relay
+fallback, useful when there's no deliverable address or the automatic email needs backup. Copy
+it if you might need it (print it, read it aloud, hand it over) — it is never shown again and
+never stored in plaintext anywhere. The student opens the link and sets their own password; the
+instructor never sees it.
 
 **Convert an existing pilot student to a real account** (Students → \[student\] → Convert):
 
@@ -40,5 +45,8 @@ students list — deactivation takes effect on their very next request, not just
 login, because `studentSession` middleware re-checks `status='active'` every time.
 
 **If a student says their activation/reset link "doesn't work":** tokens are single-use and
-time-limited (activation 7 days, reset 1 hour). Just issue a new one via Convert or Reset
-password — there's no way to "resend" the same token, and that's intentional.
+time-limited (activation 7 days, reset 1 hour). Use Students → \[student\] → **Resend
+activation** (or Reset password, for an already-activated account) to issue a new one — there's
+no way to "resend" the same token, and that's intentional (only the most recent link is ever
+valid, so there's never ambiguity about which one to use). See `docs/RUNBOOK_STUDENT_
+ACTIVATION.md` for checking whether the automatic email actually delivered.