docs(adr-016): restructure outbound design per 2026-07-21 decisions

Separate execution semantics from credential transport, and reject the
capability-flag transport / Linear-Hybrid / two-app framing.

- §2 Execution semantics: deterministic Linear ops stay direct GraphQL from
  Lambda; do NOT move to MCP or build a Linear MCP facade. Only the credential
  source changes (SM → vault).
- §3 Lambda credentials from AgentCore Identity: ONE shared abca-linear-channel
  workload identity, credential keyed linear-workspace:<id>; the 6 Lambda IAM
  roles are granted access to that one domain (N roles → 1 workload identity →
  1 vault entry), NOT six workload identities. Triggering-user identity kept for
  audit attribution only. SM refresh/write-back retires (phased).
- §4 MCP as a first-class control plane: register MCP servers + bind tools to
  agents/workflows; every registered MCP runs through the Gateway; no direct-MCP
  fallback; unsupported auth fails closed.
- Credential types: ChannelCredential (workspace, deterministic APIs),
  McpCredential (user, Gateway tools), McpRegistration (endpoint/tools/scopes/
  subject/bindings).
- Linear MCP optional: keep the actor=app ChannelCredential for Lambda; prefer a
  per-user actor=user Gateway grant under the SAME app; still needs clean live
  validation; if it fails, Linear MCP is unavailable (no direct route, no 2nd
  app). Do not claim two actor=app authorization-code tokens can coexist
  (Linear docs: non-client_credentials app tokens can't exist in parallel).
- Identity propagation UNRESOLVED: the M2M inbound JWT can't select a per-user
  vaulted MCP credential; a trusted task-user identity propagation must be
  specified before claiming per-user MCP support.

Rejected/corrected stale claims: two-flag "derived transport" as a sufficient
abstraction; six Lambda roles needing six workload identities; multiple workload
identities sharing one vault entry; one app + two app-actor consents. Rationale
grounding: Engram observation aws-samples#140.

Author: isadeks