docs: R-166 SHIPPED — the desired/in-flight/observed split (D-b)

Controller v0.189.0 implements operator decision D-b. Docs only here; no hub
change and no hub version bump.

- architecture/02-controller-module-map.md §0a — NEW, and it is the S-1 contract:
  desired (app.yaml) / in-flight (own marker file) / observed (not persisted),
  with the rule that ties them — never derive one from another. Absent desired
  state means UNKNOWN, never "running". One file, one writer. D-b's binding
  safety rule quoted verbatim.
- 00-capability-map.md — the boot-recovery row now rests on a recorded signal,
  with the three live flows from 9201. The interrupted-operation half is marked
  IMPLEMENTED, not PROVEN-LIVE: nobody killed the controller mid-backup on metal.
- OPEN-ITEMS/ROADMAP — R-166 SHIPPED with both blocking facts and their answers;
  R-157 mechanism B CLOSED and A restated as the whole item; R-170 NEW (the
  drive-backed boot gate still infers a Stop from a container count).
- STATUS.md — the "an app can stay switched off and nothing says so" line
  rewritten to what is actually left: timing.
- CLAUDE.md — end-of-session checklist gains: confirm your own last push's CI run
  went green, BY RUN ID. The failure email is a push signal; this is the pull check.
- CONTEXT.md S-12 — the rulings, and the two lessons worth carrying: a test that
  constructs the thing it should prove the caller constructs is hollow (its
  red-proof will say so), and a field-by-field struct rebuild in a save path is a
  defect on sight.

CLAUDE.md

@@ -122,6 +122,11 @@ pushes; **you (Claude Code) implement**. A file being open in the editor is NOT
   plain language, and is deliberately **not** `CONTEXT.md` — do not consolidate the two.
 - **A finding goes in `OPEN-ITEMS.md` first**, never only in a report, an audit or `STATUS.md`. Four
   items in this project were minted in a spike doc and lost (R-153/154/155, R-156/157).
+- **Confirm your own last push's CI run went green, by run ID.** CI emails on failure, which is a
+  PUSH signal — this is the PULL check that catches a lost, filtered or unread mail. Quote the run
+  id and its conclusion in the session report, e.g.
+  `curl -s "https://gitea.dooplex.hu/api/v1/repos/admin/<repo>/actions/tasks?limit=3"` → match the
+  `head_sha` to your commit. An unchecked green is an assumption, not an observation.
 
 ## Tech stack (Hub)