docs(adr): ADR-0086 authz metadata↔config boundary + cross-package composition (#2559)

* docs(adr): ADR-0086 authz metadata↔config boundary + cross-package composition (#2557)

Draws the model-wide line between authorization primitives that are package
metadata (versioned, shipped, draft/published, portable) and those that are
environment/system-admin config (live, env-specific, bound to real subjects),
and specifies how grants from several installed packages compose.

Key decisions:
- D1/D2 Classification on the DEFINITION↔ASSIGNMENT axis, recorded on the
  existing `metadata-persistence.managedBy` provenance axis (no new axis).
- D3 permission set carries owning `packageId` + per-record `managedBy`.
- D4 composition = package ships its own sets (Shape B); runtime unions;
  shared-slice (Shape A) stays an env-admin-only construct.
- D5 add `bootstrapDeclaredPermissions` to seed `stack.permissions` (closes the
  ADR-0078 inert-metadata gap; operationalizes ADR-0066 D5).
- D6/D7 package Access door = draft/published metadata scoped to the package
  slice; env-admin door = live cross-package matrix + assignment. Two doors,
  one metadata.
- Phased plan P0 (objectui scope + slice-merge), P1 (framework seeding),
  P2 (two doors + overlay/mute subtract).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KfK8SFcfhbfgE2WxX8JQDp

* docs(adr): ADR-0086 — cross-reference lifecycle umbrella issue #2561

Points readers from this ADR's package-authoring/composition slice to the
whole-lifecycle authorization gap map (P0–P3) tracked in #2561.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KfK8SFcfhbfgE2WxX8JQDp

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang