docs: the two sidecar-only paths are production-unreachable

Closing out step 10(a). The remaining `None` call sites in
persist_rendered looked like an open gap; they are not reachable in
production. Both `get_thumbnail` and the path variant of
`generate_all_sizes_background` are called only from the `ThumbnailPort`
impl, and nothing holds a `dyn ThumbnailPort` — which the existing note
in get_cached_thumbnail already recorded and a grep confirms. Live
renders go through get_thumbnail_from_blob and
generate_all_sizes_background_from_blob, both of which carry a
DedupService and dual-write.

So threading a DedupService through them would be work with no runtime
effect. Recorded at each call site instead, with the condition that
matters: gaining a real caller means taking a DedupService first, or the
gap persist_rendered exists to close reopens — sidecar-only output the
import can never see, so the tail never empties and the deletion gate
never opens.

Marks 10(a) done in the plan with that caveat stated rather than
implied.

docs/plan/derived-blobs.md

@@ -1294,10 +1294,14 @@ hardcoded SQL). New sources bolt on independently.
 10. **Import jobs + the dual-read fallback** — see the migration
    section. Revised ordering as of 2026-08-26:
 
-   a. **Consolidate onto one `persist_thumbnail`** (dual-write). The
-      blocker: today only one of four render paths writes the derived
-      row, so the import can never converge. See *Prerequisite: one
-      persist function*.
+   a. **Consolidate onto one `persist_rendered`** (dual-write) — **done
+      2026-08-26**. Was the blocker: only one of four render paths wrote
+      the derived row, so the import could never converge. Every live
+      render now dual-writes. Two paths still pass `None` and stay
+      sidecar-only, which is safe *only* because both are reachable
+      solely through the `ThumbnailPort` impl and nothing holds a
+      `dyn ThumbnailPort` — if either gains a real caller it must take a
+      `DedupService` first. See *Prerequisite: one persist function*.
    b. **`thumb_derived_import`** (shipped) and **`thumb_attached_import`**
       (shipped) — two jobs, not one, because the keying differs and that
       difference is the security boundary. A third, `transcode_import`,