docs(adr): ADR-0028 metadata naming & namespace isolation + ADR-0029 kernel object ownership (#1431)

Add two Proposed design ADRs for metadata naming-conflict resolution:

- ADR-0028: namespace as identity dimension (short names), physical names
  derived at the storage boundary, namespace as a transport addressing
  segment, app sandboxing, unified `sys` kernel contract; breakage-controlled
  phased migration (per-package namingMode + dual-read + codemod).
- ADR-0029 (prerequisite): first-party capabilities own their sys_* objects
  + behavior; small core vs capability plugins; shared reserved `sys`
  namespace with single-owner-per-object; decompose platform-objects; D7
  navigation-contribution mechanism so capability plugins inject setup menus.

Author: os-zhuang