docs(plan): record peer-auth decisions and evidence

Record the completed protocol-8 implementation, its security and lifecycle
decisions, and the final local acceptance evidence. Mark protocol-7 Call to
Play relay reviews as historical so they cannot be mistaken for current design.

Keep production acceptance honest by recording the unavailable canonical
186-game manifest corpus, real Windows/NTFS confinement and durability proof,
and representative physical-LAN evidence as external release prerequisites.

Test Plan:
- `just fmt` (passed)
- `just test` (passed; 708 workspace tests, including peer 480 and Tauri 56)
- `just clippy` (passed)
- `just frontend-test` (passed; 91/91)
- `just build` (passed; fixture-backed no-bundle build)
- `LANSPREAD_S37_MIN_MIB_PER_S=100 just peer-cli-tests` (passed; S1-S49)
- `git diff --cached --check` (passed)

organize/decision-tracking/IMPL_DECISIONS.md

@@ -20,11 +20,13 @@
   gates; the token map is only cancellation plumbing for in-flight downloads.
 - Treated a downloaded-but-not-installed game as immediately installable from
   Tauri by sending `PeerCommand::InstallGame` directly. A not-downloaded game
-  still uses `GetGame`, and the peer auto-installs after the sentinel commit.
+  uses `PeerCommand::DownloadGameFiles`; the peer derives every path, size, and
+  hash from its local catalog manifest and auto-installs after the sentinel
+  commit.
 - Removed the dead internal `PeerCommand::UpdateGame` path. The UI update button
-  now sends `FetchLatestFromPeers`, which skips local manifest serving and asks
-  latest-version peers for fresh file metadata before the normal download and
-  update transaction runs.
+  now sends the same exact-content download command. The local catalog remains
+  descriptor authority, and only authenticated peers advertising its exact
+  `ContentId` are eligible sources before the normal update transaction runs.
 - Removed the unreachable `Availability::Downloading` protocol value. Active
   operations are reported separately, and local summaries emit only settled
   availability.