docs: clarify participant access across sdk and http

[Brad-Edwards]

Summary

Correct the participant-access decision for SDK embedding and optional P2 HTTP. The host application owns caller entitlement and result release; RAES enforces only its documented runtime, transport, and governed-crossing checks.

Requirement UIDs

• API-404

Related Issues

Refs #1356

ADR Impact

• ADR-104 (amended)

Changes

• Document the P0/P1 SDK boundary, including unrestricted snapshot method access and the absence of an HTTP credential.
• Clarify P2 deployment-configured bearer/proxy identities, their broad read scope, and the legacy no-resolver projection path.
• Amend API-404, ADR-104, the runtime guide, and the ADR pin and identity index to match the corrected decision.

Test Plan

• Full completion suite required in CI before merge
• Repository policy checks required in CI before merge (documentation/workflow guardrails)
• Unit tests / integration tests: N/A — docs-only change

Targeted control-plane API tests: 3 passed. ADR immutability, identity cutover, file-local repo policy, and diff whitespace checks passed. The pre-push review cap was spent on the earlier merged version of #1356; this follow-up proceeded at the cap under the user's instruction to continue.

Ground Control Checks

• Repository policy checks required in CI before merge
• Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: (none — bug/refactor/maintenance run)
• TESTS: (none — documentation/configuration/structural-invariant run)

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.

[Brad-Edwards]

Ground Control delivery — this pull request delivers issue #1356; Phase E runs on merge.