docs(shares): R-7b v0.145.0 — CHANGELOG, CONTEXT, REUSE, README; caveats cleared

The samba_classify.go SCOPE NOTE and the README KNOWN GAP both described a gap that
R-7b closes; both now describe the sibling-shares-source execution instead.

controller/internal/stacks/samba_classify.go

@@ -18,12 +18,16 @@ import (
 //
 // The smb.conf / passdb mounts are deliberately NOT emitted — they are config, not customer data.
 //
-// SCOPE NOTE (the reported design fork, see REPORT.md): making this seam correct does NOT by itself
-// put share data into a live tier-2/offsite run. Both engines are structured around a per-app
-// RECOVERY UNIT — backup.RunTier2 short-circuits on `os.Stat(unitDir)` before it ever calls
-// GetStackClassifiedBinds, and the offsite runner enumerates settings.GetOffboxApps(). A share-only
-// infra stack has neither, and teaching them about one is more than an enumeration tweak, so per the
-// task's STOP clause it was reported rather than improvised inside the engines.
+// EXECUTION (R-7b, v0.145.0 — the gap this note used to describe is CLOSED). Share data now reaches
+// BOTH live tiers, but not through this seam: the engines remain structured around a per-app recovery
+// unit (backup.RunTier2 still short-circuits on `os.Stat(unitDir)`; the offsite runner still
+// enumerates settings.GetOffboxApps()), and Model B′ deliberately left those paths byte-identical.
+// Instead the backup package runs a SIBLING shares source off the SAME registry this file reads —
+// backup.RunSharesTier2 and backup.runOffboxSharesLeg — applying the identical rule below.
+//
+// So this function and the shares sources agree by construction on WHAT each share's class is, while
+// the sources own WHERE it goes. Keep the rule here in sync with internal/backup/shares_payload.go's
+// classifiedShares if it ever changes.
 func (m *Manager) sambaClassifiedBinds() ([]appbackup.ClassifiedBind, bool) {
 	if m.settings == nil {
 		return nil, false