docs(adr): record the authorization-cache invalidation contract and TTL bound (ADR-0127) (#12519)

Converts the accepted cross-request caching design into a decision record.
The durable rule: no authorization answer is cached without a declared
invalidation contract and a TTL bound -- both halves, always.

D1 requires both halves. D2 fixes "declared invalidation contract" to mean an
engine middleware seam, never a call-site list, because a forgotten call site
fails as silent over-permission. D3 makes coarse object-level invalidation the
baseline and gates keyed invalidation behind a measurement. D4 makes the TTL
the correctness contract and the cross-node channel a latency narrowing only,
with a non-optional boot-time posture statement. D5 requires entries to expire
at min(ttl, nextBoundary), because validity windows see no write at their
boundary and write-invalidation is blind there by construction. D6 sets the
staleness posture: grants off by default, 0 a real path, knobs in deployment
config. D7 keeps the session of record uncached. D8 names the two bypass call
sites and the one object that must not be watched. D9 fixes how the pins are
written.

Records a decision only; no implementation ships here.

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]