Closure: the design record states the sealed contract #647

Feature: #625 · Phase 7 of sealed-provider-resources.md.

1. The 3.5.x per-provider design docs drop any language describing the resource as a struct; each records the sealed shape.
2. 4-resource-management.md records what the seal buys: the resource model's guarantees — claims are true when made, identity is the catalog key, a string is a key never a constructor, the graph carries complete intent — now rest on the compiler rather than on convention, because a resource cannot be produced outside its provider.
3. Record the accepted cost: %T prints *service.resource while the URI says service.Resource. Anyone matching one against the other is wrong.
4. Status files follow.

Plan and design documents

Epic: #444 · Feature: #625