Add ACL graph architecture spec with principal-agent framework

- New acl.md: AclGraph Module definition (PrincipalNode, ResourceNode,
  DelegatesEdge, ScopesEdge, MemberEdge), principal-agent hierarchy
  with no-escalation invariant, setup-time vs runtime separation,
  multi-parent aggregation rules, cycle detection, scope semantics
- ADR-034: ACL as metagraph (not domain-specific tables)
- ADR-035: Actors become PrincipalNode entries, standalone table removed
- ADR-036: Principal-agent as DelegatesEdge with scope narrowing
- ADR-037: Setup-time definitions seed graph types, runtime instances
  are separate graphs
- Resolve OQ-03 (actors table design) — actors become ACL nodes
- Add OQ-20 through OQ-25 (delegation expiration, evaluator location,
  graph instance lifecycle, BelongsToEdge derivation, identityId
  references, scope string semantics)
- Update README.md and overview.md to reflect new doc and ADRs
- Note: multi-tenancy / graph scoping problem (no ownerId/scopeId on
  graphs table, no identity tables at this level) still needs
  resolution — identity and org tables will likely need to be added
  at this level for referential integrity

docs/architecture/overview.md

@@ -130,7 +130,7 @@ consumed by the hub and spokes, not by storage itself.
 | ----------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------- |
 | Repository/CRUD layer                     | High         | ⚠️ Not yet implemented. Typed insert, find, update, delete functions for graphs, nodes, edges. No dependency on `@alkdev/operations` — consumer wires CRUD into registry. |
 | PostgreSQL host                           | Medium       | Same table shapes, `pgTable` + `jsonb` + `timestamp` + `pgEnum`. Stub only.                         |
-| ACL graph type                            | Medium       | Access control as a graph. Informed by `@alkdev/operations`' `Identity` and `AccessControl`. Depends on CRUD layer. |
+| ACL graph type                            | Medium       | Access control as a metagraph. Principal/agent delegation, org scoping, resource access. See [acl.md](acl.md). |
 | Task graph type                           | Low          | Informed by `@alkdev/taskgraph`'s `TaskGraphNodeAttributes` and `DependencyEdge` schemas.                  |
 | Graphology bridge                         | Low          | `moduleToGraphology()` and `fromGraphologyExport()` — Phase 4 of the metagraph implementation path.    |
 
@@ -259,7 +259,7 @@ storage node attributes and operations call events), they should either:
 Open questions are tracked in [open-questions.md](open-questions.md). Key
 questions affecting this package:
 
-- **OQ-03**: Should actors be a node type or a standalone table? (open, deferred to ACL design)
+- **OQ-03**: Should actors be a node type or a standalone table? (resolved: actors become PrincipalNode in ACL graph — ADR-035)
 - **OQ-04**: Should the repository layer be host-specific or host-agnostic? (open, start host-specific)
 - **OQ-14**: Should encryption be per-attribute, per-node, or per-graph? (resolved: per-attribute)
 - **OQ-15**: Should key management be in this package? (resolved: no, application provides key ring)