doc: design for the cluster-controller legacy removal (reference only, do not merge)

[aljoscha]

Reference only. Not intended to merge. This documents the final behavior and
the rejected alternatives for the cluster-controller legacy-removal stack.

The design records the parts that are easy to rediscover incorrectly:

• why catalog-open builtin reconciliation and the runtime controller converge
  rather than compete
• why controller correctness fixes apply to the path already live in production
  and are separate from deleting unreachable legacy code
• why the sequencer cannot safely reproduce the controller's strategy union for
  either replica reconciliation or transient resource prediction
• why a forced cut-over waits for the concrete target set to exist, swaps the
  physical replica set drop-before-create, and does not wait for hydration
• how resource exhaustion becomes a retained resource-exhausted status and
  audit event while the realized set keeps serving
• why create-time scoped configuration belongs in coordinator catalog
  transaction machinery rather than SQL or the pure cluster controller

The live merge stack is:

1. adapter: fix controller-owned cluster reconfiguration #38580, correctness fixes for the already-live controller path
2. adapter: delete the staged cluster reconfiguration and direct replica paths #38103, deletion of the unreachable staged/direct implementation
3. this reference document, which can stay unmerged

Unconditional WITH (WAIT ...) acceptance landed independently as #38627. The
scheduler and system-cluster prerequisites already merged as #38101 and #38102.

[aljoscha]

not meant for merging