docs(telemetry): record why the workload stack runs anonymous Grafana admin

The setting was flagged in review as unauthenticated admin access. It is
deliberate, and it matches the sibling stack in docker-compose.yml, which
carries the same two variables and the same published port with its intent
in comments. This copy had none, so the reasoning lived only in a review
thread and was rediscovered as a finding each time the file was looked at.

Viewer would break the harness rather than harden it: the validation suite
drives the Grafana API against this instance to confirm each dashboard
provisions and loads, and the dashboards and datasources come from the
read-only mounts on the same service.

docker/telemetry/docker-compose.workload.yaml

@@ -88,11 +88,17 @@ services:
 
   grafana:
     image: grafana/grafana:13.1.2
+    # Anonymous Admin is deliberate, and matches the sibling stack in
+    # docker-compose.yml. This stack is an ephemeral local/CI backend that
+    # run-full-validation.sh brings up and tears down around a single run; it
+    # holds no durable data and is never exposed beyond the host. Admin rather
+    # than Viewer because the harness drives the Grafana API against it, and
+    # the dashboards and datasources are provisioned from the mounts below.
     environment:
-      - GF_AUTH_ANONYMOUS_ENABLED=true
-      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
+      - GF_AUTH_ANONYMOUS_ENABLED=true # No login required for local dev
+      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin # Full access without auth
     ports:
-      - "3000:3000"
+      - "3000:3000" # Grafana web UI
     volumes:
       - ./grafana/provisioning:/etc/grafana/provisioning:ro
       - ./grafana/dashboards:/var/lib/grafana/dashboards:ro