docs: resync with current state across all project docs

- design-guidelines: every dimension was stale — card frame 340x200
  (was 500x220), corner radius 6, title 15px at (20,30), row y0/dy,
  donut centre (250,110) r=55/30, topN=5, legend y0=55 dy=20, bar chart
  area [35,325]x[45,155], area chart [28,312]x[45,150], icon scale 0.75.
- code-standards: FetchContributionsAllTime signature now ctx-first,
  viewbox 500x220 → 340x200.
- codebase-summary: test coverage lists main_test.go +
  TestDonutSingleSlice/Empty; filename convention says plain kebab-case
  (no numeric prefix).
- project-overview-pdr: forks/private defaults now on, not off.
- project-roadmap: add Phase 7 (Marketplace polish — resize, numeric-
  prefix drop, v1 floating tag, rename-rollback). Renumber planned
  phases 8-11. Fix "hard width 500 px" limitation.
- deployment-guide: document update-major-tag job; note
  Marketplace listing name is `ghstats-cards`.

docs/code-standards.md

@@ -30,7 +30,7 @@ Applied in order: **YAGNI → KISS → DRY**.
 
 ### No hidden state
 
-- Profile fetchers mutate the `*Profile` argument in-place (`FetchContributionsAllTime(p, opts)`) — explicit ownership, no package-level caches.
+- Profile fetchers mutate the `*Profile` argument in-place (`FetchContributionsAllTime(ctx, p, opts)`) — explicit ownership, no package-level caches.
 - Renderers are pure functions of `(*Profile, theme.Theme)`. No side effects, no goroutines.
 
 ### Comments
@@ -58,7 +58,7 @@ Never write comments that describe what well-named code does (`// increment coun
 
 - Always XML-escape user-controlled strings through `escapeXML` (`&`, `<`, `>`, `"`, `'`).
 - Numbers formatted via `formatInt` with thousands separators.
-- Stable viewbox per card (`500×220` for most, `500×220` for profile too).
+- Stable viewbox per card (`340×200`) matching github-profile-summary-cards.
 - No `<script>` tags, no event handlers. Cards are pure markup.
 
 ## Testing