docs(architecture): ADR-015 — manage grant tier + repo-op gate, OQ-16 identity namespace

Resolves review 001 finding A-1 (critical): ADR-012 §3's "scope
git:admin OR ownership" gate is not expressible in alkcall's
AccessControl (AND-composition). Resolution is the review's option (a)
shape with the OR-term generalized: the per-repo grant action set gains
manage, authorize(record, identity, read|write|manage) becomes the
single policy function for git access and repo administration, and the
delete/update/get gate is admin scope OR manage grant (handler-side,
generic FORBIDDEN, unknown-repo = unauthorized per ADR-008). Repo
create seeds the creator's {read, write, manage} grants —
administration is grantable, so collaborators/bots/app-compiled roles
work without global scopes. Ownership stays as alkcall spawn-tracking
(mint at create unchanged); "ownership never implies git access" is
superseded.

- ADR-015 (new): manage grant tier, op gate, flat-grants-as-replication-
  substrate, opaque grant-key rule
- ADR-011: action set + policy domain amended, references updated
- ADR-012 §3: gate table replaced, two-tier paragraph superseded
- backend.md/doors.md/overview.md: gate + grant restatements, ADR tables
- OQ-16 (new, deferred(scope)): grant-key identity namespace —
  globally-comparable ids for cross-assembly/replicator grant state;
  tracker task tasks/architecture/oq-16-grant-identity-namespace.md
- review 001: A-1 marked resolved (ADR-015)
- vision.md: supersession notes (Internal-ops framing, v1 grant set)

Verification: cargo test, clippy -D warnings, fmt --check, doc --no-deps
all clean.

tasks/architecture/oq-16-grant-identity-namespace.md

@@ -0,0 +1,53 @@
+---
+id: architecture/oq-16-grant-identity-namespace
+name: OQ-16 unblock — first cross-assembly record sharing
+status: pending
+depends_on: []
+scope: narrow
+risk: trivial
+impact: component
+level: research
+tags: [external-trigger, deferred-oq]
+---
+
+## Description
+
+Tracker for OQ-16 (`deferred(scope)`): the grant-key identity namespace.
+Grants on `RepoRecord` key on opaque identity-id strings (ADR-011,
+ADR-015 §7). Within one assembly those are alkcall's cluster-local
+`Identity.id` — sufficient for v1. The question of a
+globally-comparable id format (compound `{namespace}/{id}` shapes,
+did-key/contract-derived identifiers, or (authority, local-id)
+tuples) only becomes real when repo records are shared across
+assemblies — the distributed-git/replicator phase, where a hub mirrors
+grant state published by an external authority.
+
+Constraints any resolution must satisfy are already recorded in the OQ
+entry (ADR-015 §7): grants stay flat sets keyed on opaque strings;
+alkgit never parses or interprets the id; collision-freedom is the
+identity-provider's guarantee.
+
+## Work
+
+None while blocked. When the first cross-assembly record-sharing
+deployment is designed (the distributed-git phase, or a platform app
+that federates grant state), decide the id format: either a
+payload-level namespace convention (alkgit-side, opaque strings with a
+namespaced grammar) or a family-wide identity-id format (alkcall-level
+change). Record the resolution in an ADR; update the OQ entry.
+
+## Verification
+
+- OQ-16 status matches `docs/architecture/open-questions.md`.
+- If resolved: an ADR exists and the grant-schema freeze inventory
+  (OQ-03) reflects the chosen id format.
+
+## Out of scope
+
+- Building the distributed-git replication machinery (separate phase).
+- Changing alkcall's `Identity` model (only if the family-wide option
+  is chosen, and as that crate's own decision).
+
+## Summary
+
+> Filled on completion.