docs: add provider-leak review rule and ticket-writing guidance

[shivros]

Adds two org-guidance updates stemming from the COD-437/PR-#36 provider leak review:

review.md — new blocking finding

Provider coupling. Providers are libraries, not routes: operation names, HTTP paths, core crates, and hardcoded source-string checks must never name a specific provider outside its own crate. Adding a provider = provider-crate dependency + one config entry. If adding a provider would touch core/server/cli/mcp, block and redesign.

org.md — new Ticket Writing section

• Name operations for the noun, not the source (POST /ingest, not POST /ingest/herdr)
• Tickets implying core-surface changes to add a provider are wrong — flag, don't implement literally
• Tickets inherit rulings: direction comments supersede ticket bodies, which must be updated to match

Evidence: PR TechGodHQ/iris#36 shipped ingest_herdr hardcoded into iris-mcp/iris-server/operations.yaml exactly because the ticket said /ingest/herdr. Refactor tracked in COD-453.