[DOC]: Document the settled-state gate on package configMap updates #925

When a package's configMap is edited, HandleConfigUpdates does not write the generated ConfigMap right away. It applies the change only when every selected node has the package complete with nothing running, or some node is erroring at config, interrupt or post-interrupt (in which case in-flight executors are deleted). Otherwise the diff is held and the reconcile requeues after 30s. None of this is documented, so a mid-run edit looks silently ignored.

Docs to add (suggested docs/config_updates.md, linked from docs/README.md and the README "Stages" bullet):

1. The settled-state gate and the 30s retry, in user terms.
2. Why the operator waits for the running package to finish.
3. Why it waits for all nodes, not just free ones.
4. subPath mechanics: live ConfigMap edits never reach a running pod.
5. What to do when a package is stuck (kubectl nodewright reset, or delete the Job so the package goes erroring).
6. Config-interrupt interaction: changing a key with a config interrupt also drives the package through interrupt.

Note: #887 (commit cc53f03) already documents the gate and the cluster-wide reset in docs/user-guide/custom-resource.md; what remains is the rationale, subPath, and stuck-package guidance.

Full details: #487