docs: align R2 federation and instance lifecycle contracts

Where each amended contract lands in code (all opened 2026-10-15):

flowchart LR
  subgraph spec["architecture !15 (this MR)"]
    A51["ADR-0051<br/>agreements via OEG relay"]
    A68["ADR-0068<br/>Helm apps over EWBI"]
    A53["ADR-0053 + SRM F.4a<br/>partner instance lifecycle"]
    RD["OEG instance read<br/>SRM + saved failed attempts"]
  end
  A51 -- "POST/PATCH /internal/agreements<br/>GET /internal/local-zones" --> FM35["FM !35"]
  A51 -- "ZONES ADD/REMOVE callback" --> FM36["FM !36"]
  A51 -- "/platform/v1/federation/agreements" --> OEG42["OEG !42"]
  A51 -- "Agreements dialog" --> P15["portal !15"]
  A68 -- "HELM artefact + DOCKER files" --> FM37["FM !37"]
  A53 -- "GET /internal/federated-service-instances/{id}" --> SRM37["SRM !37"]
  RD -- "GET /appinstances merge" --> OEG43["OEG !43"]

The decision that needs explicit review, the instance read:

sequenceDiagram
  participant AP as App Provider
  participant OEG
  participant DB as OEG Postgres
  participant SRM
  AP->>OEG: GET /appinstances?appId=&region=
  OEG->>SRM: GET /internal/service-instances
  SRM-->>OEG: runtime rows (SRM stays the runtime source)
  OEG->>DB: failed attempts of this App Provider, confirmed deletions
  DB-->>OEG: saved rows
  Note over OEG: add failed attempts with no endpoints or cluster refs<br/>drop rows OEG confirmed terminated<br/>same instance in both, SRM row wins
  OEG-->>AP: 200 merged list

Record the contracts exercised by the Release 2 portal test: agreement management through OEG, local-zone selection, partner zone callbacks and subscription cleanup, and Helm onboarding over EWBI. Clarify that SRM reads FM for the zone of a partner-hosted instance while leaving its local-inventory foreign key null.

The instance-read amendment needs an explicit design review: OEG supplements SRM runtime results with its own saved failed attempts, scoped by the originating operation's App Provider and the request filters. It omits runtime rows that OEG has confirmed as terminated. SRM remains the runtime source; OEG invents no endpoints or partner inventory.

Review ADR-0051, ADR-0053, ADR-0068, FM requirements, OEG instance flow/interface, and SRM F.4a together. This is the companion specification for the code MRs below, particularly OEG instance visibility and SRM termination.

Validation: documentation diff checks passed. The described combined behavior was exercised on three operator test clusters; individual implementation and integration results belong to the component MRs.