control-plane: resolve #69 review threads (api-versioning + components)

[croadfeldt]

Resolves the open review threads on the downstream dcm #69 PR (control plane). Authored on the post-rename base, so it already uses "Gating Policy". +29/−4 across two docs.

api-versioning.md

• "well-known fact" — defer the SemVer baseline (cite semver.org); §1.3 keeps only DCM's specific application, and §2 reframes the breaking-change list as DCM's explicit authoritative checklist (calling out the DCM-specific entries: idempotency, response envelope, auth-method removal, enum tolerance).
• dev deprecation timeline — dev now gets no deprecation guarantee (was P60D/P90D); dev is for iteration, versions can break without a window.
• OIS version event vs REST — §7.2 explains a version/capability change is one-to-many fan-out (event), while dispatch is point-to-point needing a result (sync REST).

components.md

• event policy vs sync REST providers — §2.4 documents the rule: fan-out / "who cares this happened?" → events; point-to-point / "I need this result to continue" → REST.
• match-condition syntax + always — §2.5 adds the match-condition grammar: expression syntax, the always reserved keyword (+ other reserved tokens), variable-path-by-reference vs literal, and unresolved-path = false.
• "document every attribute" — §3.4 adds a field reference for the cost estimation/attribution objects.

Note: the DCM-side GateKeeper → Gating Policy rename landed separately in #19 (merged). Upstream source of truth; syncs to downstream #69 once merged.