docs(plans): add the S17 phase 4 plan and its bulk-delete spec patch

Why

Decomposes the S17 Phase 4 artifact-write surface (a delete for every addressable artifact, container tag upsert and untag, bulk delete on six collections) into 38 MR-sized steps (max step number = projected MR count). Sizing is calibrated against the measured Phase 3 overruns (every Phase 3 MR exceeded 500 added LOC, median 2,435 added): one resource and one format per handler MR, seams landed before consumers (four contract MRs, scaffold apart from the shared write helpers, per-target composers, three bulk framework seams), and per-family worker chains ahead of their routes. Merging this MR is the approval gate for the step MRs.

Three decisions to review rather than infer from the diff:

• This MR also patches the S17 spec: bulk delete applies uniformly in the job, dropping the manifests partial-failure 409 that only a synchronous in-request application could produce. AC 42 and 44 are rewritten in place, AC 39's carve-out extends to all six routes, AC 64 now ends at the no-echo rule, and the echoed-input exception leaves Security Considerations. The patch also names the enqueue-unavailable 503 in Outcome and Error Cases, and corrects the blob-attachment inventory to eight tables.
• Steps 5-7 land the container_images marker schema (the marker and missing created_at columns, every statement predicate, then the partial-unique index swap, deploy-ordered so a rolling deploy never runs the old predicate-less upsert against the partial index) that S20-A's spec text also describes. The newer Phase 4 spec assigns it here, so the S20-A plan finds it in place. Flagged because both documents claim it.
• Step 38 (added in review) carries the S22 management-delete counter emit: S22 ships the interface and the acceptance contract, this plan ships the one format-dispatched call, per the merged allocation in docs(specs): wire S22's emit sites by operation... (!1350 - merged) • Pawel Rozlach • 19.3. It gates on S22's emit-API MR, which the delete steps do not. S20-A's delta-accounting table still records the pre-merge wiring ('All three are S22's sites'), drift its owner will want to absorb.

Related to S17 Phase 4: artifact writes (delete, bulk) (#313 - closed) • Hayley Swimelar

Test plan

Docs-only. markdownlint, Vale, and lint:links pass locally, and the plan's Mermaid DAG matches every step's Depends-on line (91 edges). The diff exceeds the 500-LOC review ceiling because a plan lands whole through its one dedicated plan MR, per the plan-MR guardrail. The S22 and S04-B plan MRs set the same precedent.