docs: name the real deploy path and stop restating the RLS constraint

`update_path` is not a symbol in this repo; a script move goes through
`create_script`. The re-assert's comment re-derived the disclosure argument
that already sits on `resolve_moved_to_in`, where a caller would break it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/tests/fixtures/drafts_moved_rls.sql

@@ -2,9 +2,9 @@
 --
 -- Models a script that has already been moved out of a folder the saver can
 -- reach (`mvrls_visible`, where test-user-2 is a writer) and into one they have
--- no permission on (`mvrls_secret`). A script move archives the row in place and
--- creates a new one carrying the old hash in `parent_hashes`, so this is exactly
--- the state `update_path` leaves behind.
+-- no permission on (`mvrls_secret`). A script move goes through `create_script`,
+-- which archives the row in place and inserts a successor carrying the old hash
+-- in `parent_hashes` — the state reproduced here.
 
 INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms, created_by)
 VALUES ('test-workspace', 'mvrls_visible', 'Visible', '{"u/test-user"}',

backend/windmill-api/src/drafts.rs

@@ -791,13 +791,6 @@ async fn update_draft(
             //
             // Run on the connection we already hold: acquiring a second from the
             // same pool while this transaction is open is the two-connection stall.
-            // That connection is RLS-scoped, and has to be: the write gate cleared
-            // the OLD path, and this asks where the item WENT. On a raw pool
-            // connection this answers from rows the pre-check cannot see, so a
-            // destination in a folder the caller has no permission on would both be
-            // disclosed to them and permanently refuse their save — where the
-            // pre-check's "can't see where it went ⇒ save normally" fallback says it
-            // should land.
             if applied.is_some() && !deployed_still_at(&mut tx, &w_id, kind, path).await? {
                 if let Some((moved_to, moved_by, moved_patch)) =
                     resolve_moved_to_in(&mut tx, &authed.username, &w_id, kind, path, value.0.get())