docs(notes): point to the DevGuard upstream-adapter packet

[novelKR]

Summary

This adds a dated, non-normative .github/notes/ pointer to DevGuard's W0–W2 packet for
CS-DG-UPSTREAM-ADAPTER-WORK-SPEC-1 v1.0. The packet is novelKR/DevGuard#16 at head
a67facbbebb192d83126c5afa1a9ef2d713c2e2e. The spec places handoff narrative in CodeSpace's .github/notes/,
linked from the existing trackers. This note approves nothing and changes no CodeSpace behaviour.

What changed

• .github/notes/devguard-upstream-adapter-packet.md (new). It covers:
  • the links to the packet, at its fixed head, and to Handoff: CS-RG managed-execution suspension (#75) and the DevGuard boundary revalidation (2026-09-27) #76 and Handoff: CS-RG hold, boundary revalidation and pending owner approvals (2026-09-27) DevGuard#14;
  • what stays unchanged in CodeSpace;
  • the packet's findings that concern CodeSpace: the upstream ChildFds signature change on a future pin move,
    descriptor inheritance by std and tokio children on macOS as observed in BD-1, and a transitive-dependency gap in
    the dependency gates;
  • the wording the packet drafts for docs/codex-reuse.md and docs/upstream-update.md, not applied;
  • the status, the next step and the stop boundary.

What did not change

• The Codex pin 6b9826e (rust-v0.154.0), docs/upstream-lock.md and the gitlink.
• Every documentation page, including the CS-RG hold notices.
• Manifests, locks, scripts, CI policy and the Codex adapters.
• The governance-free off path.

Verification

• python3 -B scripts/check_docs.py passed (documentation registry verified: 17 paired documents).
• git diff --check is clean, and the note contains no local absolute paths.
• Its line citations were re-read at 326bdcb.
• The packet link resolves to the pushed DevGuard commit a67facb, which was confirmed as W01: document architecture, security, and upstream pin #16's head before the push.
• scripts/validate-upstream.py (CodeSpace's validate script) not run locally; CI runs it. CI runs every leg here,
  because the policy classifies .github/** as a full-run path.

Merge and rollback

• Merge only at the exact head the owner approves (decision 2 in the packet's section 14). If the packet's head
  changes first, this note is updated to the new head before merge.
• The change is documentation only, so rollback is a revert of the merge commit.

Handoff

• Trackers: Handoff: CS-RG managed-execution suspension (#75) and the DevGuard boundary revalidation (2026-09-27) #76 and Handoff: CS-RG hold, boundary revalidation and pending owner approvals (2026-09-27) DevGuard#14. The final comments on both record this PR's number and head.
• Next step: the owner decisions in the packet's section 14.
• Stop boundary: until those decisions, no merge, no experiment, no normative PR, no pin, dependency, service or
  credential change, and no upstream submission.