feat(docker): guide clone installation and validate paired update artifacts

src/messages/en.json

@@ -4338,7 +4338,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"operations": {
 				"title": "Needs attention",