docs(architecture): resolve OQ-06/07/08 — per-repo authz, registry backing, CRUD ops

ADR-011 (resolves OQ-08): per-repo authorization — grants live in repo
records keyed on the stable logical identity id (alkcall ADR-025,
referenced); policy is alkgit-core's authorize() function (public+read
anonymous-first-class, write always authenticated+granted); alkgit
stores no identity records; vault placement resolved as nothing to
place in v1.

ADR-012 (resolves OQ-06/OQ-07): registry backing + write surface —
GitRegistryStore write supertrait (alknet ADR-035 read/write split
shape); registry-file default (per-repo record files + in-memory
index, config-seeded, op-mutable, no gitoxide); git/repo/* CRUD ops
shipped External with scope+ownership ACL (create mints ownership and
seeds creator grants; ownership never implies git access); the
two-op-kind classification recorded (open op + call ops from one
crate, per alkcall ADR-047); recorded split trigger for a downstream
platform crate.

Doc sync: backend.md (five-trait family, feature model split,
two-op-kinds), doors.md + overview.md (authorize policy, dual-kind
crate map), open-questions.md (OQ-06/07/08 resolved), README (ADR
table, current state), oq-06 tracker task closed (resolved early).

Verification: cargo test (default + --no-default-features), clippy
-D warnings, fmt --check.

docs/architecture/doors.md

@@ -22,9 +22,16 @@ and socks5 are payloads doors optionally expose. Downstream consumers
 want with the payloads they want.
 
 Auth semantics are the door's auth (http: the door's token mechanism; ssh:
-the door's key-based identity). alkgit consumes the resulting alkcall
-identity — the identity-extractor seam that ADR-006 needed exists only in
-the door, where it belongs.
+the door's key-based identity) resolving an alkcall `Identity` (the
+identity-extractor seam that ADR-006 needed exists only in the door, where
+it belongs). alkgit consumes the resolved identity and the registry
+record: the per-repo check is alkgit-core's `authorize` policy function
+(ADR-011 — public+read anonymous-first-class, write always
+authenticated+granted), run at ADR-007's step-3 position by every door
+and by the channels open-op gate. There is no door-specific auth surface
+in alkgit and no scope constant — per-repo grants replaced the
+`tty:open`-style gate (the single-scope shape cannot express
+anonymous-public fetch).
 
 ## alkhttp `git` feature (http mounting)
 
@@ -100,11 +107,14 @@ deployment's docs, not here.
 | [008](decisions/008-registry-resolved-repo-identity.md) | Repo identity | wire names are registry ids |
 | [009](decisions/009-bounded-resources-budget.md) | Budgets | limits on every session |
 | [010](decisions/010-pure-protocol-crate.md) | Pure protocol crate | doors are family infrastructure |
+| [011](decisions/011-per-repo-authorization.md) | Per-repo authorization | `authorize` policy, grants in records |
+| [012](decisions/012-registry-backing-and-ops.md) | Registry + ops | op registration surface, two op kinds |
 
 ## Open Questions
 
-- **OQ-08**: registry identity space + vault placement (narrowed by
-  ADR-010; door auth mechanics belong to the door crates).
+- None. (OQ-08 resolved by ADR-011 — door auth mechanics stay here,
+  registry identity model settled; ADR-012 §3 pins the op registration
+  surface.)
 
 ## References