Publish the kit spec: invariants, deploy-time parameters, role matrix

[pragalli]

Priority

Medium — should be addressed soon

User story / Problem statement

Currently, the Tranche 1 kit spec is spread across docs/strata-product-and-architecture.md, AGENTS.md and environments.toml, and two of its three required pieces are incomplete. The doc says the vault takes "roughly ten parameters" but never lists them, and §8.3 describes the five authorities without a per-operation role matrix. A third party cannot configure a deployment from a single published reference, which is the deliverable's completion measure.

Expected outcome

One published spec a third party can configure a deployment from, covering the three required pieces: the invariants, the deploy-time parameters, and the role matrix.

Acceptance criteria

• Invariants enumerated in one place (the §8.1 principles plus the payable-claim, split-accounting and single-step-cancellation guarantees), each stated as a testable property
• Deploy-time parameters listed as a table: name, meaning, type/units, and where set (environments.toml constructor_args), matching the deployed contracts
• Role matrix maps every privileged entrypoint to the single authority that may call it, and marks what each authority cannot do
• The spec is reachable from the repo README / docs index
• A reader can configure and deploy an instance from the spec alone, without reading the contract source

Technical notes

Consolidates, does not duplicate: links to docs/strata-product-and-architecture.md §8.1/§8.3/§8.10 and environments.toml. Overlaps #94 (compliance/freeze matrix) and depends on #112 (the doc must agree with the contracts) for accuracy. Closes the Tranche 1 "Kit spec and configuration" deliverable.