feat(spec): System 层补 ADR-0001/0003/0004 缺口 + ADR-0017 provider-bound session

ADR-0001/0003/0004 已 PINNED 但 spec/System 未落,补三模块:
- ProjectGroup: project↔飞书群 1:1 绑定 + 单射良构(ADR-0001);群失效态 OPEN
- Memory: 锚点类别 + MCP 读上下文按 run/project 授权不变式(ADR-0003)
- PermissionGrant: grant(resource×principal×role)+settings 六旋钮(ADR-0004);
  role-capability×settings-policy 组合规则 OPEN
- Prelude: 新增 ChatId 载体
- ADR-0017: AgentSession provider/model 绑定,切 model 即新 session,
  跨 session 连续性由 ADR-0003 记忆/锚点重建;agent 层 provider 无关,
  @Claude 仅为触发品牌。RunId/SessionId doc 去 provider 暗示。
lake build 28/28 绿。

docs/adr/0017-agent-session-is-provider-bound.md

@@ -0,0 +1,47 @@
+# ADR 0017: AgentSession Is Provider-Bound
+
+## Status
+
+Accepted.
+
+## Context
+
+ADR-0002 says a long-lived `AgentSession` can be reused by many runs, but never
+addressed the provider/model dimension. The agent layer is provider-agnostic
+(ADR-0001..0003 never required Claude specifically; the `@Claude` trigger name
+is a product brand, not a provider commitment). In practice the Hub routes
+model calls through an OpenAI-compatible client (e.g. OpenRouter), so a run may
+target different models — and the motivation for multi-model is **role-based
+routing**: drafting, reviewing, and triage suit different models.
+
+That raises the question ADR-0002 left open: when a teacher switches model
+mid-project, does the `AgentSession` carry live context across the switch, or
+is it bound to a single provider/model?
+
+## Decision
+
+An `AgentSession` is **provider/model-bound**. A model or provider switch
+starts a new `AgentSession`. The `AgentSession` does not carry live context
+across a switch.
+
+Cross-session continuity is not the session's job — it is carried by ADR-0003's
+project memory and anchors, which the Hub reads on demand when seeding a new
+run. This keeps B consistent with ADR-0003 ("the Hub avoids becoming a full
+chat history store"): session continuity and history continuity are the same
+mechanism, both via memory/anchors, never via a live cross-provider session.
+
+Per-run model selection (the run carries its model) is the switching point.
+
+## Consequences
+
+- Switching model mid-project = new session; the new run seeds from project
+  memory/anchors (ADR-0003), not the prior session's live context.
+- The agent layer is provider-agnostic: the agent loop is ours; model calls go
+  through an OpenAI-compatible client. No hard dependency on a single-vendor
+  agent SDK.
+- Role-based model routing (different run kinds default to different models) is
+  a product/admin configuration concern, not a spec invariant.
+- "AgentSession reused by many runs" (ADR-0002) holds *within* one
+  provider/model; it does not span a switch.
+- The `@Claude` trigger name remains the product mention brand regardless of the
+  backing model.