docs(adr): ADR-0048 addendum — publish-time / marketplace namespace exclusivity contract (#6671)

Draft the publish-time half of ADR-0048 that was deferred when the
install-time gate shipped (#1810): a global `namespace -> publisher`
exclusive registration made at marketplace publish time, in front of the
existing install gate.

Additive only — §§1-6 stand verbatim, the install gate's semantics are
unchanged, and §3.5 (namespace rename-on-install) stays deferred.

Settles the three open questions the issue left open, each argued on the
repo's three decision axes:

- Reservation granularity is the bare namespace, not
  (namespace, version-range). A table name has no version axis, and a
  range-keyed reservation would grant ownership the per-installation,
  version-blind install gate cannot honour.
- The shared-namespace whitelist is exactly the install gate's
  RESERVED_NAMESPACES + `sys`, derived from the same constant so the two
  gates cannot drift. Exemption from exclusivity is not open season:
  publishing into the whitelist is restricted to the first-party
  publisher tier.
- Existing packages are grandfathered first-come, and the grandfathered
  set is closed at switch-on and shrink-only thereafter.
- The install-time reverse lookup against the platform registry is
  specified as advisory and fail-open, never authoritative — the install
  path acquires no network dependency, and local/air-gapped installs
  behave exactly as today.

Also records the open/commercial boundary on the cloud ADR-0016 iron rule
(as applied in ADR-0105 D12): the gate that keeps an installation correct
ships open; the operated global registry is the governance surface. And
records the hard activation precondition from the ruling — the
namespace->publisher uniqueness check must land before third-party
publishing opens, because every package published before it exists
becomes a grandfathered entry that can never be revoked.

Non-goals kept explicit: version-range granularity, reservation
rename/transfer, rename-on-install, and any change to install-gate
semantics.

Fixes #1825

Co-authored-by: os-zhuang <steve@objectstack.ai>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 3 people