docs: resolve discussion #14 — keyed capability surface (ADR-0011)

[thorwhalen]

Resolves the first of the two open v1 design questions: discussion #14, layered
transformations and the unmapped-key problem. Docs only — no code.

Decision

Layer B carries no key-taking public methods. A keyed capability becomes a sibling store
over the same key space — s3dol.handles(store)[k], .urls, .info — keyed through
__getitem__, which is the one thing dol maps correctly at every wrapper depth. Non-keyed
operations (sub, prefixes, delete_many, delete_bucket) are free functions taking the
store first. url_for survives as a single guarded method purely to satisfy
dol.SupportsUrlFor.

This is correct by construction: sibling stores invoke no key-resolution primitive, so they
are immune to both failure modes found below. Verified correct unreferenced, under Pipe, under
cached_keys, under a value codec, and under a hand-rolled non-Store passthrough layer.

Why not the alternatives — all refuted by running code

• Hardened methods. inner_most_key(wrapped_self(self), k) — the form ADR-0006 §2
  prescribed — is silently wrong when nothing holds a reference to the wrapper. Because the
  prefix lives in the leaf, the wrong answer is a plausible str, so a type check cannot
  catch it. Reproduced on CPython 3.10–3.14.
• Free functions everywhere. Not categorically safe either: with a non-Store layer in the
  chain they return a plausible wrong key in three configurations, two of which the method form
  gets right.
• Option E as an attribute. A wrapper does not re-wrap a Mapping-valued attribute
  (verified). Adopted as a store instead — which is what makes it work. Design: layered transformations and the unmapped-key problem #14's lean (C+E with
  B) was right in substance; E's value comes from being a store, not an attribute.
• Option D (rebind). Already rejected upstream in dol/misc/docs/dol_issue18_design.md with
  better reasons than blast radius: rebinding binds to the innermost wrap, so it does not fix
  the Pipe case it exists to fix.

Corrections carried in the ADR

An adversarial review refuted three claims of the first draft. All are kept visible rather than
quietly fixed:

• "Undetectable" was false — a guard is writable, so methods were rejected on cost/benefit,
  not impossibility.
• s3_store(...).handle(k) is not an instance of the bug: s3_store returns a bare leaf or
  a value-codec wrap, both correct. Only a user-applied key codec triggers it.
• The family census is overwhelmingly latent, not shipping-destructive, and 12 survey
  claims were refuted outright.

Also in this PR

• The last destructive delegated method is removed: endpoint.delete(name, force=True) becomes
  s3dol.delete_bucket(endpoint, name, force=True).
• Two new blocking upstream items (ADR-0006 §3): export dol.dig.inner_most_key, and fix
  dol.content_url, which resolves with the outer key and so blocks the dol.content
  integration that dol/content.py explicitly names s3dol for.
• Two non-blocking upstream findings: the wrapped_self lost-reference hole, and
  dol.filesys.is_valid_key, which is confirmed-live broken.
• ADR-0011 added to the docs index; the superseded surface-growth rule marked in 0005 and 0009;
  0001/0006/0007/0010 amended.

Every empirical claim was executed against the local dol 0.3.58 checkout; runnable repros are
in state-of-play.md §9.

Discussion #14 stays open until this merges, then gets the resolution comment.