DEV-02: correct the operator instruction the latch rename made wrong

HANDOVER.md told an operator to "delete `sign_tripped` from
/data/state.json" to clear a sign-disagreement trip by hand. After this card
that key is a FOSSIL: the live latch is `unit/<inverter>/sign_tripped`, and
the flat one is left in the file only so a rollback finds its latch and is
never read again. Following the old instruction would delete a key that clears
nothing, on the one path an operator reaches while staring at a FAILSAFE
banner - so the instruction would look like it had failed.

DOCS.md's §SAFETY-02 section named the file but not the key; it now names both,
and says why there is one per inverter.

No code change; the suite is unaffected and green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/DOCS.md

@@ -306,7 +306,9 @@ does. That is deliberate on both counts:
   always vanishes the instant the trip works. A watchdog that took that as proof
   the fault was over would hand the inverter straight back to the loop that was
   driving the wrong way, three minutes later, forever.
-- The trip is written to `/data/state.json` and restored on startup. Restarting
+- The trip is written to `/data/state.json` — under
+  `unit/<inverter>/sign_tripped`, one key per inverter since DEV-02, so a trip
+  caused by one inverter cannot latch another — and restored on startup. Restarting
   the add-on is the first thing most people try when they see a red banner, and
   a latch that a restart clears would bring the controller back **armed, into the
   same fault, unattended** — and under a Supervisor that restarts a crashed add-on