feat: bootstrap gatekeeper-kit leaf modules - #392

Four strategies cover the taxonomy every gatekeeper picks from -- private, ACL,
tracked-set, open -- behind one ObserverStrategy seam, plus ObservationGate,
which folds a strategy's exclusions into the approval-queue authorization and
promotes newly-revealed sets only once the overseer has agreed to hide them.

ObserverTracker extends the version it came from in the two ways real
gatekeepers need: the observer and observed-set key families are named
separately (so a port keeps both of its existing prefixes), and the ACL oracle
is batched -- one provider call per admission round rather than per set. A short
or ragged oracle result denies. legacyObservedValue honors a stored `true` as
"observed", and denyMessage names the failing set.

CredentialCoordinator owns the account DO's credential record: skew-aware
refresh, concurrent callers coalesced onto one provider round-trip, and an
identity fence so a reconnect or revoke landing mid-refresh is never clobbered
by the older refresh's result. CredentialsExpiredError is the one signal that
means the grant itself died; anything else propagates with credentials intact.

CredentialSource is the facet/verifier side: a short instance-local cache over
the account DO, and the single place a provider auth failure becomes an expiry
notification.

KvTtlCache holds stable provider metadata in the facet's own storage, keyed
within a generation the caller bumps when an applied action may have invalidated
everything at once -- cheaper and more complete than tracking which entries a
write touched.

StreamingCursor fetches provider pages lazily, overlays simulation onto each
item, and merges simulation-only items at their sort position, so a resource with
a long history returns its first page without reading all of them. Pages emptied
by the filter keep it fetching rather than reporting the end early.

Both extend RpcTarget undecorated; a consumer subclasses and decorates when it
wants validated cursor calls.

Deployable discovery keys on wrangler.jsonc alone (readDeployablePackages),
not on the package name, so gatekeeper-kit is already invisible to the release
pipeline, the dev server and preview configs. AGENTS.md said otherwise --
"Each gatekeeper runs as a separate Cloudflare Worker" -- which misleads a
reader into treating the kit as deployable, or into adding a wrangler.jsonc to
make it "work".

Doing that would make it deployable and, because workerKind classifies by
prefix, a gatekeeper: shortName "kit", a routed BASE_URL, and -- since it is
absent from NO_DEFAULT_CRED_INPUTS -- a wizard demanding CLIENT_ID and
CLIENT_SECRET before anyone could install the instance. CI already caught that,
but only as three "missing fixture bundle" failures that name the symptom
rather than the cause, so pin the invariant where it can say so directly.

The internal repo's gatekeeper-shared is the same shape, so this documents an
existing convention rather than inventing one.

Records the design behind the Layer 1 modules that just landed, in the
docs/ directory alongside the other design docs. The plan drove the
implementation, so committing it puts the reasoning next to the code
rather than leaving it in a scratch file.

Reconciled against the shipped signatures before committing, since a
tracked doc reads as authoritative where an untracked one does not:

* 4.6 credentials: the upgrade() contract returns
  { credentials, legacyKeys } and reads only -- the coordinator performs
  the deletes. Documents the write order in commit()/clear() and why the
  fence goes first.
* 4.7 observers: aclObservers takes hasAccess() (answering, and only a
  literal true admits) rather than a throwing verify(); adds the
  canonicalSetId, maxTrackedSets and concurrency options, and
  observerIds() on the tracker and strategy.
* 4.9 simulation: isProvisional is a constructor option, not a method.
  Corrects the binding key to `${namespace}prov:${id}`.
* 4.10 cache: the API is cached(key, ttlMs, load); there is no public
  get/put pair, and the generation fence is internal rather than the
  caller's obligation.

Also adds a status header (Layer 1 landed, Layer 2 still proposal) and
the 4.8 key-layout tables a port needs: the counter convention is
next-unused in 9 of 12 gatekeepers but last-issued in github, linear and
spotify, where adopting the existing counter key would re-issue the last
ID; and the retained tier's derived prefix matches no gatekeeper's
existing keys.

The §4 sections are meant to track the shipped signatures. The review
pass changed six of them and left two findings deliberately unclosed,
so record both halves.

`submit` is no longer "NOT queued" -- it holds its own serial queue,
separate from the resolution queue. Split the staged-record section
into the half that closes (two submissions racing each other, and why
a live staged record could be pruned) and the half that stays open
(a submission racing its parent's rejection).

Smaller signature corrections: `markFailed` caps the reason it stores;
`retain` no-ops on a failed record; `expiresAt` must be finite;
`SimulationResult`'s incomplete arm carries `partial`, not `value`;
`resolve()` consults the classifier before the binding table; and
`readTextCapped` answers a bodyless response before the Content-Length
check and cancels best-effort.

The two declined findings go in the obligations table with the trigger
that would revive each: abandoned observer admissions holding their
slot, and a dropped action kind stranding its dependents. Both cost a
storage-format change to close, and neither has a consumer today.

This reverts commit 60f2c3a.