docs(governance): encode client-neutral global-config and data-boundary authority

[DTALEX66]

Summary

Encode the R6 task-pack's core principles into the tracked authority files and
fix the two registry/authority gaps it flagged:

• Neutrality (unbound, unlocked) — client-neutral, one canonical source →
  per-client native projection; the six clients are current adapters, not
  permanent dependencies; core schemas use stable IDs, never hard-coded
  programs/model IDs/versions/ports/paths.
• Global configuration scope — current workflow (Hermes · Codex · CC
  Switch · GitHub · Open Design · OpenHuman) plus any future AI software
  through the same Adapter contract.
• E: data volume protection — access denied by default, requires explicit
  per-path, per-operation user authorization.
• Spill governance — project artifacts never leave the project Git root;
  any spill is traceable, locatable, cleanable and migratable
  (00-governance/project-data-boundary.json#spillGovernance).
• Open Design client vs DESIGN-LAB project — two distinct identities
  (DEC-DESIGN-004); client USER_GLOBAL desired state is MANAGE with
  apply_supported=false, design capability belongs to DESIGN-LAB (IGNORE).

Gap fixes

• P0-2: adapter-registry.json now registers openhuman and
  open-design (entries 7 → 9), and source_ref uses stable id references.
• P0-1: forward authority points to tracked PROJECT_POSITIONING.md +
  config-authority-index.json; the R6 candidate is explicitly labeled
  LOCAL_CANDIDATE, not yet tracked.
• P1-1: AGENTS.md/README.md/positioning drop the stale
  OPEN-DESIGN-Assistance name in favor of the client/project split.

Verification

• verify_config_ownership.py → CONFIG_OWNERSHIP_PASS layers=8 modes=4 fields=51 forbidden=5
• verify_adapter_registry.py → ADAPTER_REGISTRY_PASS entries=9
• verify_client_neutral_manifest.py → CLIENT_NEUTRAL_MANIFEST_PASS adapters=9
• git diff --check clean