docs: address no-TEE guide review

Author: kvinwang

docs/development-without-tee.md

@@ -30,7 +30,7 @@ repository root:
 ```bash
 make os-deps
 cd os/yocto/repro-build
-RELEASE_FLAVORS="prod dev" ./repro-build.sh -n
+RELEASE_FLAVORS="dev" ./repro-build.sh -n
 ```
 
 The artifact used below is
@@ -45,12 +45,12 @@ jq '{version, git_revision, is_dev}' \
   /tmp/dstack-dev-image/dstack-dev-*/metadata.json
 ```
 
-Expected output includes `"is_dev": true`. The VMM rejects `--no-tee` for a
-production image.
+Expected output includes `"is_dev": true`. Use a development image for this
+workflow because production images do not include `dstack-tee-simulator`.
 
 ## Optional: create a nested libvirt host
 
-Skip this section when the development machine already exposes `/dev/kvm`.
+Skip this section if you want to set up the environment directly on the host.
 The outer host must enable VT-x or AMD-V and load KVM with nested virtualization
 enabled.
 
@@ -120,6 +120,7 @@ Install both binaries and the CLI on the machine that will run QEMU. You can
 also run them directly from the checkout during development:
 
 ```bash
+mkdir -p ~/.dstack-vmm
 install -Dm755 dstack/target/release/dstack-vmm ~/.local/bin/dstack-vmm
 install -Dm755 dstack/target/release/supervisor ~/.local/bin/supervisor
 install -Dm755 dstack/vmm/src/vmm-cli.py ~/.local/bin/dstack
@@ -249,11 +250,6 @@ Loading the LUKS2 header
 Device mapper /dev/mapper/dstack_data_disk is ready
 ```
 
-The LUKS2 header is kept in memory rather than written beside the ciphertext,
-so `cryptsetup luksDump hda.img` is not an applicable test. The log establishes
-that the guest opened `/dev/mapper/dstack_data_disk` and placed ZFS on that
-encrypted mapping rather than on the raw data partition.
-
 Record the instance ID, then perform a graceful restart:
 
 ```bash