docs: fold osv-sync ADRs into the living oss-packages ADR

Joana introduced docs/adr/0001-oss-packages-design-decisions.md
(PR #4151, merged 2026-05-27) as the single living record for the
oss-packages domain, with one section per decision and a Changelog
at the bottom. Our slice landed three standalone ADRs (0003 / 0005
/ 0006) before that consolidation merged. This rebases them into
her structure.

Folded into ADR-0001:

- CVSS scoring strategy (was ADR-0005) — inline v3.1, qualitative
  fallback, v4 deferred, Scope-metric validation. Adjacent to
  §OSV.
- has_critical_vulnerability semantics (was ADR-0003) — option (b)
  + MAL- override, comparator-driven derivation, idempotent
  recompute. Resolves the prior open question on this flag.
- advisory_affected_ranges uniqueness scope (was ADR-0006) — full
  tuple unique index restores the "no denormalization" invariant.

Other changes:

- Updated the Scope and current status table at the top of ADR-0001
  to list the three new decisions and remove the "flag deferred"
  qualifier on OSV.
- Removed the open question on has_critical_vulnerability — now
  decided in §has_critical_vulnerability semantics.
- Added a 2026-05-28 Changelog entry documenting the fold and the
  removal of standalone ADR-0004 (Temporal vs standalone-bin —
  superseded by §Worker architecture before merge).
- Rewrote all in-tree ADR cross-references (6 source files, 3
  migration SQL files) to point at the new section anchors instead
  of the removed standalone ADR ids.
- Updated docs/adr/README.md to list only ADR-0001 (matches Joana's
  intent in PR #4151).

All 68 unit tests still pass.

Signed-off-by: Joan Reyero <joan@reyero.io>

Author: joanreyero

backend/src/osspckgs/migrations/V1779871303__add_cvss_source_to_advisories.sql

@@ -3,8 +3,8 @@
 -- qualitative severity tag. Extensible to 'ghsa' | 'nvd' if we enrich later.
 -- Values:
 --   'osv_cvss_v3'              numeric score from a CVSS_V3 vector
---   'osv_cvss_v4'              reserved; v4 numeric scoring deferred (ADR-0005)
+--   'osv_cvss_v4'              reserved; v4 numeric scoring deferred (see ADR-0001 §CVSS scoring strategy)
 --   'osv_qualitative_fallback' synthesized from database_specific.severity tag
---   'osv_malicious_package'    MAL-* id with no CVSS vector (ADR-0003 / decision #6)
+--   'osv_malicious_package'    MAL-* id with no CVSS vector (see ADR-0001 §`has_critical_vulnerability` semantics)
 ALTER TABLE advisories
     ADD COLUMN cvss_source text;

backend/src/osspckgs/migrations/V1779871327__add_has_critical_vulnerability_to_packages.sql

@@ -1,8 +1,8 @@
 -- Critical-vulnerability flag on packages. TRUE iff there exists a critical
 -- advisory (advisories.is_critical) whose affected range covers the package's
 -- current latest_version. Maintained by deriveCriticalFlag in the osv-sync
--- worker; see ADR-0003 for the semantics (option (b) from the TODO in the
--- initial schema migration).
+-- worker; see ADR-0001 §`has_critical_vulnerability` semantics for the
+-- option (b) decision and the MAL-* override.
 ALTER TABLE packages
     ADD COLUMN has_critical_vulnerability bool NOT NULL DEFAULT FALSE;
 

backend/src/osspckgs/migrations/V1779897650__widen_advisory_affected_ranges_unique_index.sql

@@ -9,7 +9,8 @@
 -- sharing an introduced_version but differing in fixed_version / last_affected
 -- (cross-distro patches, partial fixes) no longer collide on insert and lose
 -- the wider range. Restores the osv-plan §2 decision #1 invariant: "one
--- package has many version ranges, no denormalization." See ADR-0006.
+-- package has many version ranges, no denormalization." See ADR-0001
+-- §`advisory_affected_ranges` uniqueness scope.
 DO $$
 DECLARE
     idx_name text;