feat: mirror-tier adoption — stack pointer + identity

Part of the **Borrow, Prove, Restore** design (§7, D2; ADR-039 mirror tier). Phase 4.

- Extend `Adopt Fork` to collect `SPI_STACK_RESOURCE_GROUP` / `SPI_STACK_CLUSTER` and the customer's OIDC identity triplet for **their own** stack deployment (same `spi` CLI, same facts contract).
- Document customer stack onboarding and the chart-contract sequencing rule (a service change needing a new chart env var lands a stack PR first; the fork PR deploys against the upgraded environment).
- Verify gating end-to-end: credentialed lane never runs for external heads (ADR-036); lane stays neutral-skip until a pointer is set; nothing Microsoft-environment-specific rides the mirror sync.

Start with ADR-039 §7/D2 and ADR-036, then trace Adopt Fork, the spi CLI facts contract, and the credentialed lane. Verify how the stack pointer and OIDC identity are collected, how neutral-skip and external-head gating work, and how mirror sync avoids Microsoft-specific changes. Done means the onboarding documentation, chart-contract sequencing, and end-to-end gating all match these rules.

Written by the indexing model from the issue text.