docs: define participant access trust boundary

[Brad-Edwards]

Summary

Define backend-mediated participant access while keeping RAE control-plane credentials and full snapshots inside the trusted service boundary.

Requirement UIDs

• API-404

Related Issues

Refs #1356

ADR Impact

• ADR-104 (amended)

Changes

• Publish a route and authority matrix covering projections, snapshots, operations, histories, errors, events, caches, and direct store access.
• Specify backend principal, run, participant, episode, audience, and operation checks for each participant release.
• Amend API-404, ADR-104, and runtime architecture guidance; refresh the ADR index's classified content digest.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

Five targeted HTTP and crossing tests passed. ADR pin, file-local policy, relative-link, whitespace, and identity-cutover checks passed. CI rerun pending after the classified digest correction. Organizational backend entitlement and cache behavior require deployment-specific evidence.

Ground Control Checks

• Repository policy checks required in CI before merge
• Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: API-404 ← docs/decisions/adrs/adr-104-runtime-control-plane-architecture.md, API-404 ← implementations/python/packages/raes_runtime/control_plane_api/_auth.py
• TESTS: API-404 ← implementations/python/tests/test_runtime_control_plane_api.py, API-404 ← implementations/python/tests/test_run_319_participant_flow_policy.py

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.

[Brad-Edwards]

Ground Control delivery — this pull request delivers issue #1356; Phase E runs on merge.