[patty-chow]

Summary

Clarify the workshop's local TLS prompt after an attendee hit the self-signed-certificate error.

• Prominently require Allow invalid certificates for both local Site A/B connections, rather than leaving Enable TLS (default) selected.
• Explain that tls=true stays enabled; the exception is per-connection certificate validation for the workshop's 127.0.0.1 development servers only.
• Document the observed DocumentDB for VS Code 1.0.0 wording caveat: it may show TLS/SSL Disabled for this option even though the supplied URI and runtime retain TLS encryption.
• Repeat the guidance in the attendee lab, detailed connection guide, and privately generated connection handoff. Explicitly exclude Azure/global TLS changes/password rotation.

Verification

• Both actual extension GUI connections worked in the ongoing fresh attendee Codespace when Allow invalid certificates was explicitly selected; the misleading tree warning was observed and the installed/released extension behavior inspected.
• Local suite: 58 passed, 1 existing Linux-only skip, 0 failed; 62 local documentation links passed.
• Regression assertions cover the explicit choice, tls=true, warning explanation and Azure exclusion.

This is instructional text and test coverage only. No URI, credential, database, network, extension runtime, or certificate setting is changed automatically. Remaining fresh GUI acceptance tests continue independently; this PR does not claim the entire walkthrough has finished.