[docs] Quarantine the burned firmware candidate

Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>
(cherry picked from commit 9bfc3a53b6e6ce17c213d55bd428779aba320e64)

Author: yyods

docs/specifications/firmware/browser-flashing.md

@@ -1434,3 +1434,9 @@ validated. Transitioning an active public installer to unavailable is a
 separate reviewed operation requiring an explicit truth-valued disable flag
 and a production smoke test of the disabled state; absence of staging input
 alone is never authorization to disable it.
+
+The pre-public `v0.4.1` candidate path was exposed without the required access
+control and is permanently burned. The origin MUST quarantine
+`/firmware/v0.4.1/` with a non-cacheable not-found response, MUST NOT select or
+promote those bytes, and MUST retain any forensic copy outside public routing.
+A qualified public release therefore starts at a new immutable version.

docs/specifications/website.md

@@ -258,6 +258,9 @@ VPS origin. The origin MUST:
   firmware 4xx/5xx with `Cache-Control: no-store`, and use the selected
   `release.json` SHA-256 as the deterministic cache key for both verification
   and ESP Web Tools retrieval;
+- quarantine the burned pre-public `/firmware/v0.4.1/` candidate path with a
+  non-cacheable not-found response, without deleting the retained forensic
+  copy or allowing it to enter any active selector;
 - use a valid origin certificate with Cloudflare **Full (strict)** TLS, never
   Flexible mode; and
 - expose only the required web and key-authenticated administration ports.