docs: what OTA changes in the system (docs/ota.md)

bt-update runs as root and installs helpers, sudoers, systemd units and
config; none of it is rolled back. Documents the order of stage steps, the
'old bt-update runs the OTA' pitfall and how to add a system change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

webconfig/scripts/make-package.sh

@@ -8,7 +8,9 @@
 #   collector/        (BLE GATT collector, if present in the repo)
 #   manifest.json     ({"version": ..., "created": ...})
 # and prints the package's sha256 (paste it into the web UI for integrity).
-# Note: new systemd units / apt packages still require a full deploy .tgz.
+# System files (helpers, sudoers, systemd units/config) are installed by
+# bt-update from webconfig/ — see docs/ota.md. apt packages still need a full
+# deploy .tgz.
 #
 # Usage:
 #   make-package.sh <version> [build-dir] [out-dir]