Limit Sentinel ACL to the hello channel

[yinon-bit]

Relates to VDP-4549.

Replace the broad allchannels permission in the ACL example with access to the reserved __sentinel__:hello channel, matching the Sentinel security guidance.

---

Note

Low Risk
Documentation-only changes with no runtime or configuration impact.

Overview
Documentation-only update to align Sentinel ACL guidance with least-privilege Pub/Sub access and stronger security warnings (VDP-4549).

In acl.md, the example Sentinel ACL SETUSER line no longer uses allchannels; it now uses resetchannels &__sentinel__:hello so the sentinel user can only access the reserved hello channel.

In sentinel.md, the existing __sentinel__:hello warning is expanded to describe forged HELLO messages (redirecting Sentinels, possible exposure of master credentials, spurious failovers/DoS) and adds explicit ops guidance: the doc change does not fix deployments—operators should review ACL users on monitored nodes, including default, and ensure no non-Sentinel user can publish or subscribe to __sentinel__:hello.

^{Reviewed by Cursor Bugbot for commit ec19100. Bugbot is set up for automated code reviews on this repo. Configure here.}

[dwdougherty]

Thank you for your contribution, @yinon-bit. Approved.