Architecture decision records

#	Decision
0001	ADR 0001: Content-addressed identity keyed on canonical purls
0002	ADR 0002: DSSE-signed stage events, fail closed
0003	ADR 0003: Deterministic policy in a Python DSL, mirrored in Rego
0004	ADR 0004: Reachability, runtime facts first, static import analysis as fallback
0005	ADR 0005: How the real-data benchmarks are built
0006	ADR 0006: Match OSV malicious-package records by version, not by name