docs: apply the operator's rulings on Kasm, revocation and fault injection

Retire Kasm from the catalog. Drop ACME revocation from R-TLS-02. Make L3
fault injection operator-run and exclude it from the merge gate (R-TEST-03,
ADR-0026). Update the gap register to match; Homepage authentication is now
ruled must-enforce and stays a gap until the implementation lands.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/00-vision-and-scope.md

@@ -110,8 +110,7 @@ mandatory; `SHOULD` is strongly preferred and requires an ADR to deviate.
 ### TLS & certificates — `R-TLS-*`
 - **R-TLS-01** — Every externally reachable service MUST present TLS from a **credible, trusted,
   non-self-signed** authority.
-- **R-TLS-02** — Certificates MUST be automatically **issued, renewed, and revoked** without manual
-  steps.
+- **R-TLS-02** — Certificates MUST be automatically **issued and renewed** without manual steps.
 - **R-TLS-03** — Certificate issuance MUST work for internal-only services (no requirement to expose
   a service publicly just to validate a certificate).
 
@@ -184,7 +183,9 @@ mandatory; `SHOULD` is strongly preferred and requires an ADR to deviate.
   any conforming cluster, producing machine-readable, requirement-tagged results.
 - **R-TEST-03** — A **conformance suite** MUST gate delivery: merges are blocked unless the tests
   for the touched requirements pass, and phase exits are blocked unless the phase's full suite
-  passes. "Demonstrated" means "the automated test passes," never a manual one-off.
+  passes. "Demonstrated" means "the automated test passes," never a manual one-off. Fault-injection
+  tests (R-TEST-05) are not automated: the operator runs them deliberately and records the result,
+  and they do not gate individual merges (ADR-0026).
 - **R-TEST-04** — Tests MUST be **traceable**: each test declares the requirement ID(s) it verifies,
   and a coverage report maps every `R-*` requirement to its verifying test(s). Uncovered
   requirements are a gap to close, not an acceptable state.