docs: apply the operator's rulings on Kasm, revocation and fault injection

Retire Kasm from the catalog. Drop ACME revocation from R-TLS-02. Make L3
fault injection operator-run and exclude it from the merge gate (R-TEST-03,
ADR-0026). Update the gap register to match; Homepage authentication is now
ruled must-enforce and stays a gap until the implementation lands.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/05-gitops-and-delivery.md

@@ -76,7 +76,7 @@ runs on every PR as a Gitea Actions job. **A red gate is unmergeable by everyone
 included.** The gate runs in the same pinned toolbox image locally and in CI (R-TEST-02) and
 establishes, in order: the adopted spec pin (R-TEST-06), the handoff log's format, lint, L0 schema +
 policy + repository invariants, render-equals-committed, L1 rendering, the sensitive-path approval
-policy, that the live Gitea settings match their declaration, and L2/L3 conformance
+policy, that the live Gitea settings match their declaration, and L2 conformance
 ([14](14-testing-and-conformance.md); see [known gaps](16-known-gaps.md)).
 
 Its verdict is one of three: **pass**, **blocked**, or **undetermined**. A stage that did not run is