docs(design): plan for the LLM flight recorder + WebAuthn presence + mesh discharge

WHAT: A plan-of-record design doc (docs/design/) laying out how agent-bridle
gains (1) an iptraf-style two-tier capture + flight-recorder store for all LLM
traffic, (2) verified-human-presence OCAP gating via YubiKey/fingerprint/WebAuthn
against the already-merged step_up gate, (3) a capability surface for
newt/gilamonster/hermes, (4) a live TUI traffic explorer, and (5) remote presence
discharge over agent-mesh from a phone/web-app passkey.

WHY: The operator asked for these features across the agent line. The doc grounds
every claim in current code (verified read-only across six repos) and is honest
about what is BUILT (step_up.rs verifiers/gate/policy, agent-mesh delegate_external
PoP + verify_at, agent-store WriterLog) vs. what is a PREREQUISITE — the
enrolled-credential anchor and ES256 verifier (today's WebAuthnVerifier is
Ed25519-only and reads the key from the discharge itself, so a gesture can be
self-attested in software), the sync-vs-async DischargeProvider decision for the
mesh path, signing the caveats grant source, and the persistent-proxy trust model
that supersedes ADR 0016 D3. Realizes ADR 0002's Planned invariants I13/I14.
Adversarially reviewed (37 verified findings folded in) before publication.

Co-Authored-By: Claude Fable 5 <[email protected]>

Author: hartsock