docs: reconcile architecture and Workers proposals

[szweibel]

PRs #11 and #12 describe an atomic edit engine and a Workers transition, but several revised promises still disagree with one another or current service contracts. This documentation successor records the useful shared-writer direction, the current implementation, and the decisions needed before any rewrite or migration. It adds a README pointer and a source-pinned reconciliation; it changes no application code or infrastructure.

The review covers the import log-key collision, batch events and retry/undo semantics, complete data preservation and post-resume rollback, current Doorway and Admission identity contracts, app versus person Gateway accounting, D1/DO/R2 ownership, and staging configuration/access. It uses the current shared Doorway/Admission source at f149a53d3d9570ebb8d20c57f13a6d848fc09eba: the institutional origin and issuer are current, resolver success includes accessRole and budgetScope, and Admission has no bootstrap allowlist. The document treats Slide Maker's administrator inheritance as a product-policy decision rather than a missing Admission transport.

The PR recommends using this document as the successor baseline for #11 and #12 while retaining both original proposals as design history. It does not close either PR or authorize implementation, merging, migration, or deployment. Those decisions remain with the repository maintainers.

Validation: all 19 relative Markdown links resolve; git diff --check passed; all eight bash tests/run_all.sh suites passed; normal PR CI passed at 52a33a69579dcf18308b9bad6195f0e5fc5273d4. Independent review confirmed the corrected current-service claims and the file-access, version-authority, and release-path decisions. CI cannot validate the proposed architecture, account migration, or live CUNY/Worker paths.

Base reviewed: 4cc0bf4b5b4d4a5d0372c7c1c525ab14ed54755c. Reviewed originals: #11 at 75190496c1dacdfd258e4e65563bbebd032cb5d6, #12 at 89af32f3c634eea6467e4ff048dd09d65ef61e4a.