docs(adr): ADR-0096 — execution-surface identity admission

Generalizes #2849 from an action-shaped bug to its class: metadata-driven
execution surfaces that reach the data engine without an ExecutionContext
silently inherit full authority via the security plugin's empty-principal
fall-open (#2308 and #2849 are two instances found only by adversarial
review).

Decides one invariant and four mechanisms: every engine call carries a real
principal or an explicit audited SystemGrant (D1); a single elevation
constructor systemContext(reason) (D2); identity-required engine signatures
so forgetting context is a compile error, not a fall-open (D3); an
execution-surface admission test wired into the authz conformance matrix
with a CI meta-test (D4); and a staged fail-closed strict mode (D5).
Re-bases #2849 Phase 2/3 as D6: action-level runAs adopts ADR-0073's
three-posture vocabulary and lands as this mechanism's first application.

Staged per ADR-0049: v1 is the decision record + systemContext + honest
matrix rows + the ai.exposed/trusted-body lint; signature migration and
the strict-mode default flip are evidence-gated M2+.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155bjzJZxZaZTKSMSvg6Aum

Author: claude