docs: adopt Simlock-backed Host device allocation

[thymikee]

Summary

• adopt ADR 0021, keeping Simlock as the sole managed-device allocator while Host owns remote authorization, attribution, and supervision
• define the managed runtime, lease, durable execution-claim, recovery, and maintenance boundaries for iOS and Android
• align ADR 0007 and the ADR index with the accepted Host durability boundary
• keep the change documentation-only and limited to the Host/managed-device architecture

Validation

• pnpm build
• pnpm check:affected --run
• git diff --cached --check

[thymikee]

BLOCKED at exact head d14d846. ADR 0021 §4 says only explicit cancellation or supersession terminalizes a durable allocation request, while also defining capacity and low-disk refusal outcomes. That leaves those refusals nonterminal: replaying the same requester/key can never observe newly freed capacity, but a new key is barred unless it uses supersession, whose contract assumes a prior generation/binding. This conflicts with linked Simlock #72, which requires lookup to distinguish terminal failure. Define explicit terminal allocation-failure semantics and the safe retry shape (new logical request versus a narrowly permitted retry), while keeping idempotent replay for lost-response safety; align the Simlock dependency contract if needed. Docs-only CI is clean and no device evidence is owed. No other concrete finding.

[thymikee]

Addressed at exact head 5e6f912955.

• Capacity, disk, validation, and provisioning failures are now terminal for that allocation attempt, even when cleanup remains capacity-bearing.
• Replaying the same idempotency key always returns the stored outcome; it never re-evaluates newly available capacity.
• A retry after a terminal outcome uses a new key and becomes the next generation without supersession because the old generation can no longer grant.
• A nonterminal generation still requires fenced, authorized supersession.
• Capacity retry uses retryAfterMs; disk retry requires operator remediation first.
• The linked Simlock #72 contract now states the same terminal-disposition and new-key behavior, with acceptance cases for stable replay and next-generation retry.

Validation: pnpm check:affected --run passed; the selector correctly found no runtime checks for the docs-only ADR diff.