harness: withdraw five pre-code ADRs to deferred ideas

Twenty-seven ADRs existed before a line of Go. Five specified the shape of
unbuilt mechanisms — cache validity, declared types, the settings cascade,
taxonomies, extras — which breaks the rule against abstraction before a
second concrete use, in prose where the counters cannot see it. They move to
ideas/deferred-decisions.md as recorded intent and return shaped by whatever
implements them.

Citations retargeted throughout; where one was decoration the rule now stands
on its own reasoning. Type declarations and the cascade drop to [spec] with
the MVP behaviour stated instead, so the first prompts have less to build.
conventions.md names http.ServeMux as the router, closing a hole that invited
hand-rolling a path splitter. The ADR gate now checks a number is registered
in the log rather than headed by an entry, so withdrawals resolve and invented
numbers still fail. Two architecture invariants corrected: identity no longer
implies a required language suffix, and the duplicated permalink clause is gone.

docs/conventions.md

@@ -5,8 +5,9 @@ goes through an ADR, not a diff.
 
 ## Language and dependencies
 - Go, current stable release. Stdlib first, every time.
-- `net/http`, `html/template`, `log/slog`, `os`, `io/fs`, `embed`. No web framework, ORM, router
-  library, or config library — flags plus environment variables, parsed in one place. The site root
+- `net/http`, `html/template`, `log/slog`, `os`, `io/fs`, `embed`. Routing is `http.ServeMux` with Go
+  1.22+ patterns — `GET /{section}/{slug}/` and `{path...}` for multi-segment slugs — so no router
+  library is needed. No web framework, ORM, or config library — flags plus environment variables, parsed in one place. The site root
   (`-site`, `ATELIER_SITE`) is the only required setting; default templates are `embed`ded so a bare
   site root renders (ADR-0011).
 - New dependency = ADR + human approval + `scripts/allowed-deps.txt`. `verify.sh` enforces it.
@@ -37,9 +38,9 @@ wants splitting.
 - No `init()`. No package-level mutable state. No singletons. Wire explicitly in `cmd`.
 - Accept interfaces only where a second implementation exists; return concrete types.
 - `ctx context.Context` first when a call can block or be cancelled — not decoratively.
-- Never call `time.Now()` outside a `clock.go`. Stages read the clock through an injected accessor and
-  declare a validity window with it (ADR-0013); `verify.sh` fails on any other caller, because a
-  forgotten window serves staleness silently.
+- Never call `time.Now()` outside a `clock.go`. A render that reads the clock is only true for a while,
+  and an injected accessor is what makes that expressible later; `verify.sh` fails on any other caller,
+  because a forgotten expiry serves staleness silently.
 - Comments explain *why*, never *what*. Delete a comment narrating the next line. One stating a
   non-obvious invariant is worth ten describing control flow.