docs: record the deferred solution method-policy questions in-code (#297)

[antoinetoussaint-byte]

Closes#297.

Summary

• Issue solution: remaining method-policy open questions (successor to #295) #297 is a cross-repo tracker: every one of its four tasks needs a caller that does not exist in core — the CLI solution command group (in the codefly binary repo) and the host executor. I confirmed nothing in core drives the lifecycle through solution.Client or any ceiling; only the definitions and the interceptor install in agents/manager/loader.go exist. So there is no substantive code deliverable in core for these tasks, and none is fabricated here.
• The load-bearing assumptions the tracker worries about are already regression-guarded by tests (TestSolutionRPCMethodPolicyIsMachineEnforceable pins Render = REGISTRY_READ/LOCAL_WRITE; TestOperationCeilingsAdmitExactlyTheirRPCs pins the Inspect < Scaffold < Render < Publish cut). What was not recorded anywhere durable is the reasoning that these are provisional — it lived only in the transient solution: wire first host caller and settle the method-policy open questions #295 → refactor: collapse the Solution two-API split onto solution.Client (#295) #296 → solution: remaining method-policy open questions (successor to #295) #297 trackers, which is exactly what the tracker feared losing.
• This gives that reasoning a durable home next to the enforcement code, and sharpens one doc comment that over-stated the guarantee: the Ceiling doc claimed the constructors give the ceiling "a provenance," but that is only intent provenance (which operation a caller named). The gate enforces caller-asserted intent, not an authority-derived grant — a real trust-boundary caveat a reader of EnforcingClientInterceptor should not miss.

What is not done here (remains open, cross-repo)

Per the issue's own premise, all four tasks "only become answerable once a real caller exists," and that caller is not in core:

• Wire the first host caller — the CLI solution command group lives in the codefly binary repo.
• Validate the ceiling vocabulary / Confirm the Render network assumption — both need the real host operations and the host executor implementation.
• Give the ceiling a real provenance — needs the consumer to shape it at a trusted chokepoint.

Closing #297 discharges its role as a core-side placeholder (the deferred design context now lives in the code); the actual work moves to the repos where it can be done. If the team would rather keep #297 open until the cross-repo caller lands, drop the Closes #297. line on merge.

Test plan

• go build ./solution/...
• go vet ./solution/...
• go test ./solution/... (documentation-only change; behavior and existing guard tests unchanged)

🤖 Generated with Claude Code