docs(adr-0143): D5 records manage_connector_connections' default holders (ruling B) (#28456)

<!-- claude-projects-attribution: {"github_login":"os-tesla"} -->
_Requested by **Tesla** · [project
thread](https://claude.ai/code/project/chan_01AXsQkLFKRdQCqQ3RTr6Jao?thread=cmsg_01AXsQkLFKRdQCqQ3RTr6Jao6NziWpbTDqMqVqQDfDXvBa)_

Fixes #28427

Clause-②: no
Metadata-protocol: none

**Tier H.** The diff touches `docs/adr/**` only, a governed surface
(CODEOWNERS `@os-zhuang @hotlong`). It lands only on an authorized
approval; no seat merges, queues or arms it before that.

## 维护者速读

- 改了什么：ADR-0143 D5 加一条记录：`manage_connector_connections`
的默认持有者是平台管理员和两个组织管理员权限集（`organization_admin`，以及经派生得到的
`organization_admin_no_bypass`），其余岗位只能显式授予。
- 为什么改：卡 #28427 第 4 项要求把裁决 B 记进 ADR。代码已由 #28441 落地（8e874038），本 PR
只补这条决策记录，让读 ADR 的人看到默认持有者。
- 风险与回滚：只改文档 4 行，不改任何代码路径，记录的是已落地的行为。回滚即 revert 本 PR。
- 先看：`docs/adr/0143-outbound-connector-auth-is-open-tier.md` 的 D5
节新增的一条。
- 两分钟验证：打开该文件 D5 节，读新增的那一条，应与 #28441 的默认授予一致。
- 需要你做的：os-zhuang 审批本 PR（Tier H），之后席位落地。

## What changes

ADR-0143 D5 already said who may connect is "a capability check the
server slice declares". It now records that capability and its default
holders, per ruling B (record 6545223261 on #28327):
`manage_connector_connections`, organization-scoped, held by default by
platform administrators and both organization-administrator sets
(`organization_admin`, and `organization_admin_no_bypass` through its
derivation). Every other position holds it only by explicit grant. The
behaviour shipped in #28441 (squash 8e87403); this line is its record.

## Acceptance notes

- Split from #28441 so that PR was not held as Tier H, as the card
allows. This PR closes the card.
- No changeset: `docs/adr/**` publishes nothing (`skip-changeset`).
- The branch is the card thread's platform-assigned branch. After
#28441's squash merge the remote branch was gone; this head merges
`origin/main` into the old tip and adds one commit, so the diff against
`main` is the ADR file alone.

## Verification

Local, on the PR head: `node scripts/pm/dispatch-gates.mjs --commands
--repo objectstack-ai/objectstack` derived 21 families for the 1-path
change set. Each was run with stdin from `/dev/null`, and its exit was
captured by redirect before any pipe. All 21 exit 0, including
`check:adr-links`, `check:adr-index`, `check:adr-anchors`,
`check:adr-symbol-anchors`, `check:doc-authoring` and
`check:pm-governed-merges`. `--ran`: `21 derived famil(ies) accounted
for — 21 run, 0 NOT-MEASURED`.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01L9qibxkKcPULsq3fo4JFAX)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

docs/adr/0143-outbound-connector-auth-is-open-tier.md

@@ -226,6 +226,10 @@ materialization.
   rule 5).
 - Who may connect, reconnect or revoke is a capability check the server slice declares. Whose grant a
   run then uses is the [first decision](#q1--connection-ownership-and-execution-identity).
+- That capability is the organization-scoped `manage_connector_connections`. Its default holders are platform
+  administrators and both organization-administrator sets (`organization_admin`, and
+  `organization_admin_no_bypass` through its derivation); every other position holds it only by explicit grant
+  (ruling B, record 6545223261).
 
 ### D6 — An integration grant is never a sign-in method