docs(conformance): record that the matcher debt is half paid

The content-scan half of the 'stop keying on doc-header tokens' follow-up is done
(ci/touched-requirements.sh). The path-map half remains: clusters/* and ci/* are
still keyed wholesale to R-ENV-02 + R-GITOPS-01, which is why those two stay in
DOCUMENTED_GAPS. Notes the accepted consequence for header-declared manifests.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

DECISIONS-LOG.md

@@ -1064,6 +1064,12 @@ LiveMigratable). Conformance scaffold coverage **36/51 (70.6%)**.
    second rule the log cannot record which requirements a change concerned without thereby claiming
    to have touched them, and the very commit that explains a mis-attribution re-triggers it.
    Removed lines still count (deleting a `conformance.home.k3s/R-*` tag touches that requirement too).
+   **Known consequence, accepted:** a manifest whose *header* declares the requirements it serves
+   (e.g. `platform/keycloak/keycloak-realm-import.yaml`) no longer contributes those IDs unless the
+   change touches a line carrying them. That is the intended semantics — the harness debt was
+   written as "stop keying on **doc-header tokens**" — and the authoritative signal, a test's
+   `conformance.home.k3s/R-*` label, is still detected. Verified: a range spanning conformance and
+   platform YAML changes still resolves R-NET-01, R-OBS-02/04, R-STATE-01/02 and R-TEST-01..04.
    **This is a gate-semantics change — flagged for review.** It is a tightening of attribution, not
    a weakening: no requirement is exempted, `DOCUMENTED_GAPS` is untouched, authoritative
    declarations (test tags, Kyverno policies, ServiceDefinitions) all live in YAML on lines a real