Track the full deferred surface: 64 entries registered ahead of their capability

Every behaviour the analysis identified that the SDK cannot yet express now
has a manifest entry with a deferral stating exactly what is missing at this
commit: the subscriptions/listen runtime family (types vendored, runtime
absent, all carrying the greppable re-open token), the requestState
integrity obligations (application-owned, the SDK passes opaque state
through), the extension declaration surface, the legacy 2025 jsonschema wrap
family (era-bound to the cells where it applies), the hosting-side auth
surfaces, stdio-2026 service, and the cross-AS credential obligations
(m2m credentials re-spelled into the as-binding family, targeting the spec
obligation rather than another SDK's knob).

Deferral reasons are re-grounded at this commit - no stale premises, no PR
numbers, no internal references; two stale source attributions upgraded to
the spec URLs that carry the requirement verbatim. Cells unchanged (946):
deferred entries register coverage debt without running anything.

Author: maxisbey