docs: attenuation by narrowing design doc

[ci-belphegor]

Explanation

Design doc for attenuation by narrowing: a restricted form of attenuation in which every method of the derived capability is an unaltered forward to the same method of the capability it narrows, admitting a subset of that method's arguments. The restriction buys something worth having — narrowings of a common capability form a lattice whose join is computable syntactically, so overlapping grants combine without ambiguity.

Also adds a narrowing entry to the glossary.

This document is normative for semantics. The implementation follows in the rest of this stack.

Notes for reviewers

Four claims in this document were corrected during implementation, each after being measured rather than argued about. They are worth knowing because they are the parts most likely to be wrong again:

• A delta position landing in a rest guard constrains every trailing argument, not only the one named — a rest guard is a single pattern. It stays sound, and errs toward less authority than intended.
• pathUnder confines nothing on its own. A pattern cannot see inside a segment, so ['srv', 'data/../../etc'] satisfies pathUnder(['srv']) and resolves to /etc. The capability must reject malformed segments separately.
• fs does not actually enforce anti-aliasing, which an earlier draft claimed it did. lstat follows every intermediate component, so makeNoSymlinksCaveat catches only a final-position symlink. Documented as an unmet obligation with a Roadmap entry rather than fixed here.
• No typed array can cross an exo boundary (@endo/pass-style rejects Buffer and Uint8Array as mutable; harden does not help), so readFile takes a required encoding and returns a string.

Stack

PR 1 of 12. Base: main.