docs: record the measured storage cost and the new crate boundary

Updates the ADR log, architecture, limitations, perf table and README to match
what now exists, rather than what was expected.

**The perf number was wrong and is now honest.** The M0 figure of 0.279 MB
excluded SQLite entirely — the placeholder binary never referenced the crate, so
dead-code elimination dropped it. With the daemon actually opening a database it
is **1.364 MB**, of which bundled SQLite is ~1.1 MB. That is 1.1 MB of the 5 MB
budget spoken for, leaving 3.8 MB for D-Bus, X11 and a UI toolkit.

This is the first number that makes the section 5 budget feel like a budget
rather than a formality, and it turns ADR-4's bundled-vs-system-linked choice
into a real trade-off with a measured price on both sides.

- ADR-4 marked accepted and implemented, with that trade-off left open.
- ARCHITECTURE.md documents why `blocker-storage` is a sibling crate and not a
  submodule: the dependency direction is what keeps the zero-dependency purity
  proof automatic rather than a grep someone can route around.
- LIMITATIONS.md drops the stale "storage has no I/O" shortfall and records the
  bundled-vs-system question instead, plus the fact that `LockState` still always
  evaluates to Normal.
- README status table and layout updated.

Co-Authored-By: Claude Code <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -182,10 +182,17 @@ APK size cost is unacceptable, which is a measurement before it is a decision.
 | `usage` | foreground-time and launch-count accumulation into daily and hourly buckets |
 | `lock` | lock levels, the friction ladder's timing, monotonic anti-tamper |
 | `never_block` | the section 1.5.4 safety list |
-| `storage` | the SQLite schema and its fail-open recovery policy |
+| `storage` | *(separate crate: `blocker-storage`)* the SQLite schema and its fail-open recovery policy |
 
-`storage` has no I/O behind it yet — see `LIMITATIONS.md`. The schema is written
-and reviewed as text so it can be reviewed before it is compiled.
+`blocker-storage` is a sibling crate, not a submodule. It depends on
+`blocker-core`; `blocker-core` does not depend on it, and depends on nothing at
+all. That direction is what lets `tests/purity.rs` keep checking "blocker-core has
+zero dependencies" — an automatic proof that the engine cannot do I/O — instead of
+the weaker and easily-routed-around alternative of grepping the source for
+`rusqlite`.
+
+Both crates occupy the same layer of the diagram above: storage is shared by every
+platform and contains no platform code.
 
 ## Where the platform crates start and stop