docs(adr): a gateway dispatch is a probe, and the gateway records every fleet request's outcome (ADR 0021)

[V3RON]

ADR 0021 for #329. It replaces ADR 0016 §6's fleet join and narrows ADR 0014 §6. Task #431 implements it, and #347's usage rules now follow it.

• Probe. Every gateway dispatch carries fleetRequestId. Only the gateway's uplink may set it, and only with noWait. A worker never queues a probe.
• The worker declines, never rejects, a probe. Every refusal or failure of a probe is lease.declined, whatever the reason. The worker makes no judgement about whether the gateway will retry.
• The gateway records every outcome itself. It emits request.granted when it hands a grant to its caller. It emits lease.rejected for every other ending, with the new reason worker-failed (+ code, worker) for failures on a worker. A gateway stop or crash is closed on read, at its next daemon.started.
• Usage. Fleet outcomes and waits come from the gateway's own events and clock. Device facts come from relayed events, matched by worker and worker lease id. declined counts events. On a worker, probes are counted apart from local requests.
• Protocol +1. An older worker is incompatible.

Why: #347's review round 3 found that a stale worker's relayed no-wait refusal counted as a request's outcome. Four spec-check rounds on #431 shaped the rest.

Refs #329, #431

Written by an agent.