docs(runtime): select reusable execution architecture

[Brad-Edwards]

Summary

Select reusable execution machinery while retaining RAE's semantic authority across CTFs, OT twins, AI security sandboxes, product tests and mixed IT/OT recovery. The decision chooses self-hosted Temporal/PostgreSQL for distributed execution and preserves local compositions; it does not ship a runtime rollout or enable P3.

Requirement UIDs

• API-404

Related Issues

Refs #1350

ADR Impact

• ADR-113

Changes

• Define state/worker ownership, authenticated invocation, ledger/engine recovery, supervision and deployment boundaries with a component diagram.
• Define contextual failure/retry policies with scenario and nested scope defaults, local overrides, bounded attempts and distinct fresh trials.
• Retain seven-candidate experiments and their exact source hashes; add a local recheck of AnyIO, SimPy, DBOS, Temporal and SQLite.
• Register/pin ADR-113 and add API-404 DOCUMENTS traceability while preserving requirement status and existing conformance claims.
• Preserve original DBOS probe bytes with a scanner exception constrained to one synthetic value/path/rule, verified by a real-scanner regression.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

Targeted verification: 41 existing operation-supervision tests, 51 profile/cleanup-contract tests, 3 witness tests, and 4 Temporal verification regression tests passed. A fresh Temporal run also passed the stronger terminal-status verifier. Five bounded local probes passed. File-local repository policy, ADR index/pin, requirement governance, 203 relative links and all 13 retained source hashes passed. Full suites run only in CI. API-404 remains ACTIVE with its existing implementation/test links; this change adds DOCUMENTS links for the design and evidence. The real-scanner regression passed after demonstrating the original false positive, and verifies other values, paths and rules remain detected.

Ground Control Checks

• Repository policy checks required in CI before merge
• Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: (none — bug/refactor/maintenance run)
• TESTS: Retained synthetic witness tests and candidate-probe assertions; these establish mechanism observations, not new API-404 production conformance., API-404 ← implementations/python/tests/test_issue_1350_fixture_secret_scan.py (design-evidence publication only; no runtime conformance claim).

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.

[Brad-Edwards]

Ground Control delivery — this pull request delivers issue #1350; Phase E runs on merge.