docs(architecture): ADR-015 — manage grant tier + repo-op gate, OQ-16 identity namespace

Resolves review 001 finding A-1 (critical): ADR-012 §3's "scope
git:admin OR ownership" gate is not expressible in alkcall's
AccessControl (AND-composition). Resolution is the review's option (a)
shape with the OR-term generalized: the per-repo grant action set gains
manage, authorize(record, identity, read|write|manage) becomes the
single policy function for git access and repo administration, and the
delete/update/get gate is admin scope OR manage grant (handler-side,
generic FORBIDDEN, unknown-repo = unauthorized per ADR-008). Repo
create seeds the creator's {read, write, manage} grants —
administration is grantable, so collaborators/bots/app-compiled roles
work without global scopes. Ownership stays as alkcall spawn-tracking
(mint at create unchanged); "ownership never implies git access" is
superseded.

- ADR-015 (new): manage grant tier, op gate, flat-grants-as-replication-
  substrate, opaque grant-key rule
- ADR-011: action set + policy domain amended, references updated
- ADR-012 §3: gate table replaced, two-tier paragraph superseded
- backend.md/doors.md/overview.md: gate + grant restatements, ADR tables
- OQ-16 (new, deferred(scope)): grant-key identity namespace —
  globally-comparable ids for cross-assembly/replicator grant state;
  tracker task tasks/architecture/oq-16-grant-identity-namespace.md
- review 001: A-1 marked resolved (ADR-015)
- vision.md: supersession notes (Internal-ops framing, v1 grant set)

Verification: cargo test, clippy -D warnings, fmt --check, doc --no-deps
all clean.

docs/architecture/backend.md

@@ -20,7 +20,8 @@ Five traits, kept small and orthogonal — the protocol crate never sees
 gix types:
 
 1. **`GitRegistry`** — repo id → `RepoRecord` (storage root, visibility,
-   grants keyed on the stable logical identity id — ADR-011). Async
+   grants keyed on the stable logical identity id, action set
+   `{read, write, manage}` — ADR-011, ADR-015). Async
    `resolve`; the authoritative mapping (ADR-008); resolution failure is
    indistinguishable from authorization failure (ADR-007). Authorization
    is alkgit-core's policy function evaluated on the record (data in the
@@ -30,7 +31,9 @@ gix types:
    (`put_repo`/`update_repo`/`remove_repo`; alknet ADR-035's read/write
    split shape). The `git/repo/*` ops wrap it (ADR-012 §3). Grants ride
    the record, so grant mutation is `update_repo` (convenience wrappers
-   additive later, two-way).
+   additive later, two-way) — which is also the app's promotion path
+   (roles/teams compile to flat grants upstream; ADR-015 §6) and the
+   shape a future replication sync would write through (ADR-015 §8).
 3. **`GitRefs`** — listing for advertisement (refs + peeled tags + symref
    targets, the ls-refs response data) and ref transactions (CAS apply
    for receive-pack, name validation per git ref rules + reserved-
@@ -123,12 +126,16 @@ planned: call ops only):
   yields the duplex git session.
 - **Call ops** (`git/repo/{create,delete,update,get}`) — the JSON half:
   thin `OperationSpec`+handler pairs over `Arc<dyn GitRegistryStore>`,
-  `Visibility::External`, always-on (no gitoxide), gated by
-  `required_scopes` (global tier) + ownership (self-owned tier, alkcall
-  ADR-011 mint-and-own at create). Registered by the assembler wherever
-  it wants them exposed. Managing records (op ACL) and git access (repo
-  grants) are different capabilities — ownership never implies git
-  access (ADR-011, ADR-012 §3).
+  `Visibility::External`, always-on (no gitoxide). `create` is gated by
+  the static registry check (`required_scopes: ["git:repo:create"]`);
+  `delete`/`update`/`get` carry an empty `AccessControl` and the handler
+  evaluates the ADR-015 gate — scope `git:admin` OR the record's
+  `manage` grant, via the `authorize` policy function, generic FORBIDDEN
+  denial, unknown-repo ≡ unauthorized (ADR-008). Registered by the
+  assembler wherever it wants them exposed. Managing records (op scopes)
+  and git access (repo grants) are distinct sources — but the record is
+  the single per-repo authz surface, and repo creation seeds the
+  creator's `{read, write, manage}` grants (ADR-015).
 
 ## Design Decisions
 
@@ -139,8 +146,9 @@ planned: call ops only):
 | [008](decisions/008-registry-resolved-repo-identity.md) | Repo identity | wire names are registry ids |
 | [009](decisions/009-bounded-resources-budget.md) | Budgets | limits flow into gen/ingest |
 | [010](decisions/010-pure-protocol-crate.md) | Pure protocol crate | traits in-crate, impls behind features |
-| [011](decisions/011-per-repo-authorization.md) | Per-repo authorization | grants in records, policy in core |
-| [012](decisions/012-registry-backing-and-ops.md) | Registry + ops | write trait, file default, CRUD ops, feature split |
+| [011](decisions/011-per-repo-authorization.md) | Per-repo authorization | grants in records, policy in core (amended: ADR-015) |
+| [012](decisions/012-registry-backing-and-ops.md) | Registry + ops | write trait, file default, CRUD ops, feature split (gate amended: ADR-015) |
+| [015](decisions/015-manage-grant-and-op-gate.md) | Manage grant + op gate | `manage` tier, admin-scope-OR-manage gate, create seeds manage |
 | [013](decisions/013-receive-pack-state-machine.md) | receive-pack | thin-pack ingestion, transaction CAS, report framing |
 | [014](decisions/014-v2-negotiation-ack-loop.md) | Negotiation | ack loop, `common_haves` seam, no `ready` |