docs(architecture): resolve review #002 Tiers 1-3 — mechanical and consistency fixes

Governance (Tier 2):
- Advance ADR-022 and ADR-023 from Proposed to Accepted (specs already
  depend on their types as source of truth)
- Amend ADR-015: mark Decision 3 and Assumption 6 as superseded by ADR-022;
  update handler_identity type to CompositionAuthority
- Amend ADR-002: note handle() signature revised by ADR-007 (BiStream → Connection)
- Amend ADR-004: note 'enrich/replace' AuthContext language superseded by
  ADR-011's immutability model; update to describe set_identity on Connection
- Update main README ADR table to show ADR-022/023 as Accepted

Spec-ADR consistency (Tier 3):
- Add abort_policy: AbortPolicy field to OperationContext struct (ADR-016
  Decision 6 mandated this but the spec omitted it)
- Define AbortPolicy enum (AbortDependents | ContinueRunning) with Default impl
- Add abort_policy to build_root_context and LocalOperationEnv::invoke()
- Define the OperationEnv trait explicitly with invoke() and
  invoke_with_policy() methods (was referenced as 'must remain a trait'
  but never defined)
- Specify From<StreamError> for HandlerError impl with exact variant mapping
- Add Connection::from_quinn() / from_iroh() constructors (was referenced
  as Connection::new() but never defined)
- Remove undefined CertAuthorityEntry placeholder from AuthPolicy v1 (will
  be added additively when alknet-ssh lands)
- Fix config.md key-differences table: rate limits are in DynamicConfig,
  not StaticConfig

Mechanical fixes (Tier 1):
- overview.md: 'closes the QUIC stream' → 'closes the connection' (stale
  from pre-ADR-007 model)
- overview.md: OQ-04 entry updated from stale 'defer to implementation'
  to 'resolved: static at startup'
- mnemonic-derivation.md: remove duplicate helper functions block (incomplete
  first copy, complete second copy)
- ADR-003: add iroh (feature-gated) to alknet-core dependency list, added
  by ADR-010
- ADR-021: fix ambiguous 'W1 drift issue from the vault review' cross-reference
- ADR-022: rephrase FromCall 'leaf locally' to 'leaf in the local registry'
- ADR-017: add error_schemas to from_call mirror list and services/schema
  step (inconsistency with ADR-023)
- ADR-016: fix self-referential citation ('ADR-016 Assumption 5' → 'Assumption 5')
- Add ScopedOperationEnv::empty(), allows(), new() and
  CompositionAuthority::none(), new() impl blocks (referenced but undefined)
- Add call.completed clarification for non-subscription calls
- Add services/schema leading-slash normalization note
- Crate README ADR tables: add missing ADR-013 (call), ADR-015 (core),
  ADR-006 + ADR-010 (vault)
- Vault README: add consolidated 'Known Source Drift' table tracking all
  four drift items (OsRng, unwrap, CURRENT_KEY_VERSION, spawn bug) in one
  place, including the two previously missing from README

docs/architecture/decisions/015-privilege-model-and-authority-context.md

@@ -113,15 +113,23 @@ enumerate the internal call tree.
 
 ### 3. Handler identity is carried on OperationContext
 
-`OperationContext` carries both the caller's identity (who invoked me) and the
-handler's identity (who am I acting as):
+> **Note**: This decision's `handler_identity: Option<Identity>` type was
+> superseded by ADR-022, which replaced `Identity` with
+> `CompositionAuthority` — a declared authority bundle that is not a peer
+> identity and is not resolvable through `IdentityProvider`. The core
+> decision (authority switch, not ACL skip) holds unchanged. See ADR-022
+> Decision 2 for the current type.
+
+`OperationContext` carries both the caller's identity (who invoked me) and
+the handler's identity (who am I acting as):
 
 ```rust
 pub struct OperationContext {
     pub request_id: String,
     pub parent_request_id: Option<String>,
     pub identity: Option<Identity>,            // Caller's identity (inbound)
-    pub handler_identity: Option<Identity>,    // Handler's identity (composition authority)
+    // Type changed to Option<CompositionAuthority> by ADR-022:
+    pub handler_identity: Option<CompositionAuthority>,  // Handler's composition authority
     pub capabilities: Capabilities,
     pub metadata: HashMap<String, Value>,
     pub env: OperationEnv,
@@ -273,11 +281,14 @@ Principle of least privilege.
    is more important than debuggability from the wire.
 
 6. **The handler identity is a full `Identity` (with scopes), not a special
-   principal type.** This reuses the existing `Identity` type and `IdentityProvider`
-   infrastructure (ADR-004). If handler identities need different resolution
-   semantics (e.g., not resolvable through `IdentityProvider`), a separate type
-   may be needed. The assumption is that the existing identity infrastructure
-   suffices.
+   principal type.** ~~This reuses the existing `Identity` type and
+   `IdentityProvider` infrastructure (ADR-004).~~ **Superseded by ADR-022
+   Decision 2**: composition authority is a declared authority bundle
+   (`CompositionAuthority`), not a peer `Identity`. It is not resolvable
+   through `IdentityProvider` and does not represent an inbound caller. The
+   distinction is necessary because a handler is not a network peer — its
+   authority is declared by the assembly layer at registration, not resolved
+   from credentials.
 
 ## References