docs(archreview): remediation plans + fix flagged doc drift

Add the 7 per-domain design+implementation plans (archreview/plans/) with
an index, produced from the 2026-07-08 architecture review.

Fix two confirmed doc drifts the review flagged (theme #5):
- CLAUDE.md KNOWN LIMITATION 2: the continuous-historization historized-ref
  feed IS wired (AddressSpaceApplier.FeedHistorizedRefs -> UpdateHistorizedRefs
  -> recorder); rewrite to reflect that value-capture is code-complete and only
  the live end-to-end + restart-convergence verification remains.
- CLAUDE.md ScriptAnalysis gating: endpoints use Roles=Administrator,Designer
  via RequireAuthorization, not the FleetAdmin policy.

CLAUDE.md

@@ -220,7 +220,8 @@ help, document formatting, and tag-path completions inside `ctx.GetTag("…")` /
 runtime publish gate uses, so what the editor accepts/rejects matches publish
 exactly. The backend lives in
 `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ScriptAnalysis/` (six minimal-API
-endpoints under `/api/script-analysis/*`, gated by the `FleetAdmin` policy).
+endpoints under `/api/script-analysis/*`, gated to the `Administrator,Designer`
+roles via `RequireAuthorization` in `ScriptAnalysisEndpoints.MapScriptAnalysis`).
 See `docs/ScriptEditor.md` for the full guide. Scripts may use the `{{equip}}` token for equipment-relative tag paths that resolve per-equipment at deploy time — see the "Equipment-relative tag paths" section in `docs/ScriptEditor.md`.
 
 ## Scripted Alarm Ack/Shelve
@@ -355,13 +356,18 @@ dotnet test --filter "Category=LiveIntegration"
 The live suite **skips cleanly** when these env vars are absent (safe to run offline on macOS). It is the
 gate the operator runs on the VPN before trusting the cutover.
 
-### KNOWN LIMITATION 2 — continuous-historization value-capture is not yet live
+### KNOWN LIMITATION 2 — continuous-historization value-capture wired; live end-to-end verification still pending
 
 The `ContinuousHistorizationRecorder` is fully wired (actor + FasterLog outbox + gateway value-writer +
-meters) but is currently spawned with an **EMPTY historized-ref set** (`Array.Empty<string>()` in
-`WithOtOpcUaRuntimeActors`): the deployed address space — and thus the set of historized tag refs — is built
-later at deploy time, not at actor-spawn time, so there is no clean ref set to resolve at wiring time. With
-an empty set the recorder **registers interest in nothing and historizes nothing**. **Reads and alarm-writes
-work today**; the recorder's value-capture is the remaining gap, blocked on a `SetHistorizedRefs`-style feed
-driven off the deployed composition (a tracked follow-on). Until that feed lands, continuous historization
-records no values.
+meters). It is spawned with an **empty *initial* ref set** (`Array.Empty<string>()` in
+`WithOtOpcUaRuntimeActors`) because the deployed address space — and thus the historized-ref set — is built
+later at deploy time, not at actor-spawn time. **The ref-feed gap is now closed:** on every deploy the
+`AddressSpaceApplier.FeedHistorizedRefs` hook computes the added/removed historized-ref delta and posts it
+through `ActorHistorizedTagSubscriptionSink` → the recorder's `UpdateHistorizedRefs` message, and the
+recorder keeps the full set and re-registers its dependency-mux interest. So the recorder converges to the
+deployed set of historized value tags from the first deploy onward (the feed is a non-blocking, deploy-safe
+`Tell`; a faulting feed can never break a deploy). **Reads and alarm-writes work today, and the value-capture
+path is code-complete.** What remains is the **live gate**: an end-to-end verification against a real gateway
+(deploy → dependency-mux value delta → outbox append → `WriteLiveValues`) plus a restart-convergence test
+proving the recorder re-registers the deployed set after a process restart. Until that live verification runs,
+treat continuous value-capture as unproven-in-production rather than absent.