docs: specify SSE replay cursors

[shivros]

Summary

Adds the spec-only successor change add-sse-replay-cursors for COD-427. It gates implementation behind review of the contract; the previously merged realtime proposal is untouched.

The contract specifies:

• an explicit generated HTTP/CLI cursor input for subscribe_events, plus SSE id: frames;
• a server-owned 512-entry in-memory replay broker with one upstream subscription per active provider and atomic replay-to-live handoff;
• process-incarnation-qualified cursors, so pre-restart cursors deterministically expire;
• generated 400 invalid_replay_cursor / 409 replay_cursor_expired contracts and CLI --include-cursor projection metadata;
• no MCP projection, provider-specific public surface, durable replay, or implementation code.

Validation

• git diff --check
• structural OpenSpec artifact check (the openspec CLI is unavailable on this host)
• cargo build --all-targets
• cargo test --all-targets — 217 tests passed
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo run -p iris-codegen --bin iris-codegen -- check
• two-model review panel, with restart-collision, broker-ownership, retention, generated-error, and CLI-source-of-truth findings resolved; both re-reviews approved.

Review gate

This is an OpenSpec contract-review PR. Do not merge automatically. Implementation must wait for this spec to land on main.

[shivros]

🤖 Automated Review Panel

Reviewer A — GPT-5.6 Terra

APPROVE after re-review. The revised contract resolves the initial blockers: restart-safe incarnation-qualified cursors, server-owned broker ingress/fan-out, fixed 512-entry retention, generated 400/409 error contracts, and CLI projection metadata. The frozen predecessor remains untouched and implementation is correctly gated on approval.

Reviewer B — Gemini 3 Flash

APPROVE after re-review. No blocking issue remains in cursor lifecycle, atomic replay-to-live semantics, upstream task ownership, retention/expiry behavior, or generated-surface source-of-truth requirements.

Resolution record

The first review pass found five real contract gaps (restart cursor collision, ambiguous broker ownership, unspecified retention capacity, undeclared generated errors, and undeclared CLI output-mode metadata). The spec was amended and both reviewers approved the revised diff.