#4277 docs: slim remote device leases ADR

Summary

Slim ADR 0007 while keeping the lease decision and its constraints. Eleven files; scope includes owner documentation and citation updates. No linked issue.

Migration ledger

• Status, context, decision, rationale, alternatives, and consequences: decision and gaps stay in the ADR; duplicated overview and incident history are removed.
• Lease lifecycle, recovery without a proxy restart, admitted work, allocation, human control, and macOS app leases: daemon contracts move to packages/daemon/docs/remote-device-lease-contracts.md.
• Heartbeat scheduling and failure handling: packages/daemon-client/docs/remote-device-leases.md.
• Revyl shared provider lease table and runtime identity: packages/provision-kit/docs/remote-device-leases.md.
• Device-spec decision remains in the ADR; parsing, returned-device checks, and daemon refusal move to packages/contracts/docs/lease-device-spec.md. CLI help stays in src/commands/schema/cli-help.ts.
• Limrun inactivity window: already in website/docs/docs/limrun.md. Web tenant isolation remains in ADR 0037. Citations follow their owners.

Wording drift

The daemon default is one minute; proxy and eligible cloud connections request five minutes. Provider-reported instance end ends leases and sessions, with teardown failures preserving the typed reason (#4257). Cloud provider fencing and the incomplete-rental gap retain their original scope and modality. Pre-admission heartbeats run throughout the phase. The Revyl in-memory 32-byte identity constraint is restored. No other scope or modality change is intended.

Validation

Head: e28e0f25dd. Install, build, format, doc prose, and doc links passed. Affected gate passed with exactCommit=true and checkoutChanged=false; receipt .tmp/validation/run-qXzhrn/receipt.json. Hosted and device lanes remain GitHub-owned or skipped; CI is required at the pushed head. Runtime behavior is unchanged. No independent reviewer was available; the diff received a local review.