docs(adr): ADR-0091 D1 — delegated_from is retired from sys_user_permission_set (#11911)

D1's declaration list still said delegated_from was a lifecycle-audit column
shared by both grant tables. The maintainer ruling on #9730 (ADR-0049
enforce-or-remove: REMOVE), landed via merged PR #9998, retired it from
sys_user_permission_set — it stays declared and runtime-enforced only on
sys_user_position. No PR since had amended docs/adr/, so a reader of D1 alone
still saw the pre-#9730 shape.

Amends the one sentence in D1's declaration list to record the post-#9730
shape and point at the #9730 ruling and the ADR-0087 semantic ledger entry
ups-delegated-from-column-retired.

Part of #9997


Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-steve

docs/adr/0091-grant-lifecycle-and-recertification.md

@@ -64,7 +64,10 @@ sells recertification campaigns on top of exactly this substrate.
 | `valid_until` | Grant is inactive **at and after** this instant (half-open `[from, until)`, UTC). Null = never expires. |
 
 Plus lifecycle-audit columns shared by D3/D4/D5: `reason` (free text, required
-for delegation/break-glass rows), `delegated_from` (user id, D3),
+for delegation/break-glass rows), `delegated_from` (user id, D3 — retired from
+`sys_user_permission_set` per the #9730 ruling, ADR-0049 enforce-or-remove;
+still declared and runtime-enforced on `sys_user_position` only — see the
+ADR-0087 semantic ledger entry `ups-delegated-from-column-retired`),
 `last_certified_at` / `certified_by` (D5).
 
 Deliberately **not** effective-dated: `sys_position_permission_set` (bindings