docs: ADR-0013/0015 status corrections + ADR-0023/0024/0025/0026 drafts

[Destynova2]

Summary

Doc-only PR covering two ADR-status corrections and four new ADR drafts.

Part 1 — Status corrections (zombie statuses)

Audit found two ADRs marked done whose implementations are deferred. Both
flip back to accepted with inline status notes; designs remain final and
binding, only the implementation flag has been corrected.

• ADR-0013 (storage refactor on atomic files + JSONL) — redb persistence
  remains active in v0.36.x (GrobStore in src/storage/mod.rs still in
  use; no ~/.grob/spend/*.jsonl files written). A-7 deferred to v0.37+.
• ADR-0015 (indirect prompt injection coverage) — A-6 implementation
  deferred; framework design final but no production code merges yet.

Part 2 — Four new ADRs (status: proposed)

• ADR-0023 — Preset Naming and Composition Strategy. Formalises the
  shipped catalogue: [meta] tier taxonomy (base,
  audience-specific, experimental), kebab-case naming convention,
  presets do not nest, and grob preset info validation gate before
  shipping built-in. Compliance overlays declared as separate
  [meta] kind = "overlay" concept.
• ADR-0024 — Preset-as-Compliance-Template. Compliance presets are
  packaged decisions bundling routing topology, policies, ADR-0022
  [endpoints.compliance] metadata, and [meta] compliance_reviewed
  attestation. Customer overlays may tighten but never loosen the base
  posture. Update lifecycle covers routine review, certification
  renewal, and major posture change.
• ADR-0025 — RPC Mutation Transactionality and In-Flight Visibility.
  Resolves the open question on issue Runtime config mutation for RPC namespaces (7 TODOs) #228. In-flight requests see
  pre-mutation snapshots (reusing ADR-0001's snapshot()); persistence
  is atomic with the in-memory swap (rollback on disk-write failure);
  per-namespace mutex permits parallel writes across namespaces; every
  mutation emits an AuditEvent::RpcMutation { namespace, action, before_hash, after_hash } to the Sokolsky pipeline.
• ADR-0026 — Model Name Canonicalization Policy. Records the fixed
  rule set landed in PR feat(routing): canonicalize model names before [[models]] lookup #307 (lowercase, strip -latest, strip 8-digit
  date suffix, dot-to-dash version on a known-prefix gate, Anthropic
  family-version reorder), idempotence guarantee, operator escape
  hatches (per-endpoint actual_model mapping or table patch), and
  2-minor-release deprecation window for renamed model aliases.

CHANGELOG [Unreleased] records the additions under a Documentation
heading. No code changes.

Test plan

• markdownlint passes on all six modified/added files
• lychee resolves all internal cross-references ([ADR-NNNN](NNNN-*.md))
• no-hardcoded-version CI guard passes (no vX.Y.Z literals in
  new ADRs; existing v0.34.0 reference in ADR-0015 already
  whitelisted by the guard)
• All ADRs follow MADR 4.0 frontmatter + Context + Decision Drivers
  + Considered Options + Decision Outcome + Consequences structure
  matching ADR-0018's style