docs(arch): upstream backend classes + bucket layout, plus wiki + /create-pr conventions

[hanwencheng]

Summary

• arch.md §4b — first-class split between Class A (per-request IAM) and Class B (bearer-token) upstreams, with per-class enforcement story and "how to add a new upstream" guidance.
• arch.md §7a — bucket layout: bucket = (data class) × (deployment) × (env), prefix = wallet. Documents why one bucket cannot hold vault + memory + audit (bucket-level config matrix), and the $BUCKET → $VAULT_BUCKET / $MEMORY_BUCKET / $AUDIT_BUCKET fan-out.
• arch.md §3a — canonical-name rows for vault_bucket / memory_bucket / audit_bucket.
• arch.md §7 row 4 reworded around vault_bucket; new row 5 "Egress enforcement" so the future broker-proxy has a documented pluggable slot.
• wiki/upstream-backend-classes-exercise-vs-distribution.md (new) — full design rationale: two-security-concerns table, Class A/B property tables, granularity flow per class, bucket-layout consequences, design rule, open questions (broker-as-egress-proxy trade-offs, atomic-revoke gap, vault backend swap).
• CLAUDE.md — new Wiki-location policy (./wiki/ is canonical; .omc/wiki/ is gitignored scratch; don't use wiki_add / wiki_ingest MCP tools — they default to the wrong place) + new /create-pr policy (hybrid git commit / jj git push / gh pr create workflow inside Claude Code worktrees where jj cannot colocate; jj-only outside worktrees).

Why

Recent design conversations surfaced that the §6 STS-to-vault pipeline subsumes two semantically distinct cases that arch.md did not distinguish:

• Class A (AWS-native): upstream re-authorizes every request — the pipeline IS both distribution and exercise.
• Class B (bearer-token, e.g. OpenRouter): upstream trusts the bearer once minted — we secure distribution but exercise enforcement is provider-bounded.

Operators reading §6 alone could not tell which payload is which. The two cases differ on revocation, blast radius, and what the provisioner must do. Pinning the split as §4b + a wiki page makes the design intent legible.

Separately: S3 bucket-level configuration (Versioning, Object Lock, BucketEncryption, Lifecycle, CloudTrail data events) cannot be set per-prefix, and vault / memory / audit have conflicting requirements on every dimension. Wallet-as-prefix is sufficient for per-actor isolation but cannot replace per-data-class bucket separation. §7a documents this orthogonality.

Test plan

• arch.md renders cleanly on GitHub (new tables, mermaid unchanged).
• wiki/upstream-backend-classes-exercise-vs-distribution.md renders cleanly on GitHub (relative links resolve to ../docs/spec/..., ../crates/..., sibling ./key-security.md).
• Repo-wide grep -rn "\.omc/wiki" --include="*.md" returns zero hits (all references migrated to wiki/).
• arch.md §3a + §4b + §7 + §7a cross-link to each other and to the wiki page without dead links.

Follow-ups (not in this PR)

• Fan out $BUCKET → $VAULT_BUCKET / $MEMORY_BUCKET / $AUDIT_BUCKET across scripts/operator-workstation.env, scripts/setup-broker-host.sh, docs/stage7-demo-and-verification.md, and the role-policy templates. Arch.md documents the migration; the rename across operator surfaces is its own change.
• wiki/agent-role-and-usage-hdkd-per-agent-omni.md is referenced by CLAUDE.md + arch.md §4a but does not exist anywhere yet (pre-existing dead reference).