docs(architecture): refresh explainers and spec to the shipped system

Bring docs/architecture/ in line with the current repo:

- feature-conformance-explainer.html: drop the "proposed / not yet
  implemented" framing — the system is shipped. Four enforcement points
  become five (adds `pnpm fallow` as the whole-codebase audit). Manifest
  playground shows `coverage`, `analyticsEvents`, `rateLimit`,
  `requiresConsent`. Milestone / anchor / open-question sections kept
  but marked historical.
- agent-first-workflow-and-conformance.md: four → five enforcement
  layers; layer table gains the Fallow row.
- di-explainer.html: bind-production sample rewritten to show
  wireUseCase() + assertFeatureConformance() + the full wrapper stack
  (span → capture → audit? → analytics? → consent? → rateLimit?).
- data-flow-explainer.html: same bind-production refresh for the
  data-flow narrative.
- audit-and-compliance-explainer.html: AuditAction enum 6 → 10 values
  (CONSENT_GRANT / WITHDRAW / RESTRICT / UNRESTRICT);
  BindProductionContext example gains analytics, consentFactory,
  rateLimit.
- vertical-feature-spec.md: §5 layout lists the 8 optional cores plus
  core-testing; §9.5 hedges the turbo.json snippet against the live
  file; §10.4 drops the dated "360 tests" metric for the ADR-020
  coverage architecture; §11 gains a historical lead-in pointing at
  docs/decisions/ as the canonical 25-ADR set.

docs/architecture/audit-and-compliance-explainer.html

@@ -983,7 +983,11 @@ footer .colophon {
   | <span class="s">"UPDATE"</span>
   | <span class="s">"DELETE"</span>
   | <span class="s">"EXPORT"</span>
-  | <span class="s">"PERMISSION_CHANGE"</span>;
+  | <span class="s">"PERMISSION_CHANGE"</span>
+  | <span class="s">"CONSENT_GRANT"</span>
+  | <span class="s">"CONSENT_WITHDRAW"</span>
+  | <span class="s">"RESTRICT"</span>
+  | <span class="s">"UNRESTRICT"</span>;
 
 <span class="c">/**
  * `from_where` fragment per DPA. IP truncated to /24 (IPv4) or /48 (IPv6)
@@ -1381,6 +1385,7 @@ footer .colophon {
   <span class="k">const</span> <span class="n">ctx</span>: <span class="t">BindProductionContext</span> = {
     <span class="n">tracer</span>, <span class="n">logger</span>, <span class="n">config</span>, <span class="n">bus</span>, <span class="n">queue</span>, <span class="n">realtime</span>, <span class="n">realtimeRegistry</span>,
     <span class="h"><span class="n">auditLog</span></span>,                                                <span class="c">// ← NEW</span>
+    <span class="n">analytics</span>, <span class="n">consentFactory</span>, <span class="n">rateLimit</span>,              <span class="c">// optional (ADR-024 + ADR-025)</span>
   };
 
   <span class="k">await</span> <span class="n">bindProductionAuth</span>(<span class="n">ctx</span>);