fix: harden v2 custom widgets and Workshop (#6480)

apps/docs/docs/widgets/custom-api/index.mdx

@@ -38,7 +38,8 @@ Enable the definition before you use it. The definition must also be available t
 
 Each named request declares its minimum board permission. This permission does not depend on the HTTP method.
 
-Queries and actions can use GET, POST, PUT, PATCH, or DELETE. The `kind` value controls runtime behavior.
+Queries and actions can use GET, POST, PUT, or PATCH. DELETE is valid only for actions so it can never run
+automatically while a board loads. The `kind` value controls the remaining runtime behavior.
 
 A DELETE request requires full board permission and confirmation. An anonymous viewer cannot run an action.