docs(specs): carve 405, 407, and 426 out of S16's live-list row

What this changes

S16's error matrix says every non-2xx from a tags/list or referrers upstream propagates. This carves 405, 407, and 426 out of that row and answers them 503 UNAVAILABLE with Retry-After, the same way S16 already carves the three out of a manifest or blob read.

RFC 9110 makes a header mandatory on each: Allow on a 405, Proxy-Authenticate on a 407, Upgrade on a 426. None can be stated truthfully from a proxied list read, so propagating one bare emits a response this spec's own 405 rows call malformed. The reasoning is the carve-out row's own; the spec never said why it stopped at manifest and blob reads.

A live list resolves no cache row, so there is no cache leg ahead of the answer. An upstream that has not implemented the OCI 1.1 referrers API is not one of these three: it answers 404, and the OCI Distribution Spec v1.1 makes a client that receives it fall back to the referrers tag schema, so that upstream keeps taking the propagating row. The new row says so, so the next reader does not have to re-check it.

Also adds a ## Follow-ups bullet for the two live-list gaps the same amendment issue carries: a sub-400 status that is answered rather than propagated, and the Link rewrite plus the OCI-Filters-Applied size bound being narrower than the relay ## API Contracts describes.

Merge order

This MR merges before !1716 (merged), or in the same batch as it. Never after.

!1716 (merged) ships the code arm this spec text describes. Until this MR merges, that arm contradicts S16's list row as written, so a reviewer reading the spec and the branch together sees a conflict rather than a decision. Merging this first closes the window; merging it after leaves the code and the spec disagreeing for as long as the gap lasts.

No code changes here, so nothing in this MR depends on !1716 (merged) landing first.

Related to #795