Add architecture review findings and address documentation issues

Review of all ADR documents (001-007) and peripheral architecture docs
identified 3 critical, 10 warning, and 7 suggestion issues.

Addressed in this commit:
- W-1: Add draft qualifier to ADR-002 reference to incremental exploration
- W-2: Add Alternatives Considered section to ADR-001
- W-3: Add Document Lifecycle section to README.md (draft/stable/deprecated)
- W-4: Clarify includeCompleted semantics (only 'completed' status triggers exclusion)
- W-5: Document file I/O runtime constraints in frontmatter.md
- W-6: Add ADR reference to architecture.md redirect
- W-7: Verify CVE-2025-64718 (confirmed real, improved description)
- W-9: Convert workspace-absolute paths to relative/monorepo references
- S-7: Add future ADR-008 note to incremental-update-exploration.md

Critical issues (C-1, C-2, C-3) and remaining warnings (W-8, W-10, S-4, S-5)
were addressed by a parallel agent in a prior commit.

All 16 review tasks created and resolved.

tasks/architecture/c-1-construction-error-policy.md

@@ -0,0 +1,25 @@
+---
+id: architecture/c-1-construction-error-policy
+name: Fix construction error policy contradiction
+status: completed
+depends_on: []
+created: 2026-04-26T09:10:18.462977719Z
+modified: 2026-04-26T09:10:18.462978343Z
+scope: narrow
+risk: high
+---
+
+# Description
+
+**Review ref**: C-1 (Critical)
+**Files affected**: `docs/architecture/errors-validation.md`, `docs/architecture/api-surface.md`
+
+`errors-validation.md` line 119 states "Construction never throws" but then lists `DuplicateNodeError` and `DuplicateEdgeError` as exceptions. `api-surface.md` line 60 documents `addTask` as throwing `DuplicateNodeError`. These contradict each other.
+
+Resolve one of two ways:
+1. **Preferred**: Replace "Construction never throws" with "Construction throws only for precondition violations (duplicate IDs), not for data validation issues." Make the exception explicit rather than contradicting the principle.
+2. Make `addTask`/`addDependency` idempotent (no-op on duplicate) so the principle holds, with `validate()` as the path to detect duplicates.
+
+Also update `api-surface.md` to be consistent with whichever path is chosen.
+
+**Source**: `/docs/reviews/architecture-review-2026-04-26.md` C-1