Add design specs for the provider architecture and permission model epic

docs/superpowers/specs/datadome-header-allowlist.md

@@ -0,0 +1,10 @@
+# DataDome request-header allowlist (normative, checked-in)
+
+The complete set of response-named header pointers the security channel
+(hook spec §4a) may copy into the owner-scoped publisher-upstream
+overlay. Every `X-DataDome-*` name not listed here is rejected. Adding a
+name is a reviewed commit to this file and a spec change.
+
+| Header                | Direction                   | Scope                                                                                                |
+| --------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------- |
+| `X-DataDome-ClientID` | response → upstream overlay | Owner-scoped overlay only; never the shared request view; vendor egress governed by sign-off item 23 |

docs/superpowers/specs/decisions/README.md

@@ -0,0 +1,6 @@
+# PR #986 product-decision records
+
+One file per open row of the migration spec §8 sign-off table
+(`NN-title.md`), recording the decision, the deciders, and the date. The
+table links each record as its row closes; a row without a record here is
+open, and implementation is blocked while any row is open.

docs/superpowers/specs/gpp-registry-snapshot.md

@@ -0,0 +1,35 @@
+# GPP registry snapshot (normative, vendored)
+
+The pinned per-section accepted versions for the permission spec's §4.5
+map. This file is the single reproducible authority; updating it is a
+reviewed spec change. A mapped section presenting a version not listed
+here is treated as malformed-present (permission spec §4.4).
+
+| GPP section ID | Section                                             | Accepted version(s) |
+| -------------- | --------------------------------------------------- | ------------------- |
+| 6              | US Privacy string (uspv1, carried as a GPP section) | 1                   |
+| 7              | usnat                                               | 1                   |
+| 8              | usca                                                | 1                   |
+| 9              | usva                                                | 1                   |
+| 10             | usco                                                | 1                   |
+| 11             | usut                                                | 1                   |
+| 12             | usct                                                | 1                   |
+| 13             | usfl                                                | 1                   |
+| 14             | usmt                                                | 1                   |
+| 15             | usor                                                | 1                   |
+| 16             | ustx                                                | 1                   |
+| 17             | usde                                                | 1                   |
+| 18             | usia                                                | 1                   |
+| 19             | usne                                                | 1                   |
+| 20             | usnh                                                | 1                   |
+| 21             | usnj                                                | 1                   |
+| 22             | ustn                                                | 1                   |
+| 23             | usmn                                                | 1                   |
+| 24             | usmd                                                | 1                   |
+| 25             | usin                                                | 1                   |
+| 26             | usky                                                | 1                   |
+| 27             | usri                                                | 1                   |
+
+Version values were captured from the IAB registry at the time of
+writing and are re-verified against the official registry as part of
+ratification review; any correction is a change to this file.