docs(core): state the write-bit recoverability trust model in the spec

[cuibonobo]

Summary

Finishes the remaining work items from #59, now that its two prerequisites — #60 (undelete API) and #61 (unified versioning rule) — have both landed.

#59's own carve-out (hard delete is owner-only) merged first in #75. The rest of its checklist was explicitly blocked on undelete and association versioning existing, so it was left for follow-up. With both now in place, this PR:

• Spec §Permissions gains a new subsection, "The write bit: a recoverability trust model," stating the model plainly:
  • A verb table: update, associate/dissociate, restoreVersion, and soft delete are all reversible (via versioning or undelete()); hard delete is never reachable through the write bit.
  • The owner/creator-only list: hard delete and setPermissions() sit outside the coarse bit entirely, because they're either irreversible or privilege-bearing — the existing setPermissions carve-out stops being an unexplained special case and becomes the pattern's first stated instance.
• Layer 2 (grants) gains a short note on why the two permission layers use different granularities — record-level write stays one coarse bit, grants stay precise per verb — and that associate()/dissociate() ride update-own/update-any rather than getting their own grant action.
• Test: the specific cross-entity recoverability scenario from Record-level write stays one bit — but everything it permits must be recoverable, and irreversible verbs get carved out #59's own test checklist — a write-holder soft-deletes a record, and the owner can undelete it — now that the undelete API exists to make this checkable.

Test plan

• Added test: a write-holder soft-delete is undeletable by the owner — recoverability holds
• pnpm --filter @haverstack/core typecheck — clean
• pnpm --filter @haverstack/core lint — clean
• pnpm --filter @haverstack/core test — 224 tests passing
• prettier --check on changed files — clean

Refs #59, #60, #61

---

Generated by Claude Code