fix(decision-records): assign counters in argument order

[trungfinity]

promote A B assigned counters in sorted order, not the order given. Observed in a real promotion: promote OPER DASH produced DASH=0041 and OPER=0042, because DASH sorts first. There was no way to choose which co-promoted record got which counter.

That matters whenever one record of a set is the foundation the others name — the record they build on should read as the earlier decision, and only the caller knows which one that is. It is not cosmetic once the set is merged: the counter is the permanent identity, so getting it backwards is only fixable by hand-renumbering records that are already referenced.

The fix

promote now keeps a deduped list in argument order and numbers from it. The seed set stays a set for reference classification, so the blocking-set closure, --deref, --allow-replace and the co-promoted counter↔counter rewrites are all untouched. _do_deref takes the ordered list and derives its own set.

The refusal messages each printed a suggested command built with sorted(). Under the new behaviour that would silently pick the counters for you, so each now prints the drafts in the order given:

• the blocking-set suggestion prints the requested drafts first, in the caller's order, then whatever the closure pulled in — still a complete, valid promotion, and re-running it verbatim keeps the counters the caller asked for
• the blocking listing is ordered to match the command it prints, and says the counters follow that order
• --deref and --allow-replace re-run suggestions preserve the caller's order, so adding the flag does not change the numbering

Tests

Three added. Co-promotion in a deliberately reverse-alphabetical order (ZZZZ before AAAA) lands the counters on the arguments; the same pair reversed proves the order is read rather than incidental; and the blocking refusal's printed command is extracted from the error text and executed, asserting both that it is a valid promotion and that the requested draft keeps the first counter.

Two of the three fail against the previous implementation, which I checked before writing the fix. Suite: 100 pass (82 existing + 3 new here, plus the repo's own 15).

references/promotion.md, the module usage block and the --help text now state that co-promoted counters follow argument order.