bug(architect+implementer): ADR amendment + code update repeatedly diverge across multiple revisions

## Summary

ADR-009 (HMAC verification at RouteFrame) in switchboard-blue went through three revisions during Wave 3, with code-vs-spec drift surviving each transition:

| ADR-009 version | Prescription | Code state | Adversary catch |
|---|---|---|---|
| v1.5 (initial mint) | "Single RLock spans steps 1–6" | Code released lock between forwarding lookup and HMAC verify | Pass-1 M-1 |
| v1.6 (amended after pass-1) | "Lock-free HMAC verify with defensive copy of FrameAuthKey BEFORE RUnlock" | Code still dereferenced `entry.FrameAuthKey` AFTER RUnlock | Pass-2 M-1 |
| v1.6 (no further amendment) | Same | Code finally added the defensive copy line | Pass-3 CONVERGED |

In each transition the architect amended the ADR text correctly, and the implementer/test-writer updated SOMETHING in response — but not the full code change the ADR required.

## Specific failures

- **v1.5 → v1.6 transition:** user decided to amend ADR to permit lock-free verify. Architect re-dispatch correctly amended ADR text and reasoned the implementer was already lock-free. But the implementer's PARALLEL re-dispatch only updated the comment at routing.go:115; it didn't notice the ADR now mandated a `[32]byte` defensive copy of `FrameAuthKey` BEFORE RUnlock.
- **Pass-2 catch:** adversary noticed the comment at lines 116-117 ("FrameAuthKey is copied out before the lock is released") was FALSE against the code beneath. Took an explicit pass to surface the gap.

## Pattern

Agents update narrative (comments, ADR text) without verifying code-vs-narrative alignment. Each individual agent dispatch was "successful" by its own scope, but the cumulative result drifted.

## Mitigation suggestions

1. **Pre-commit hook for ADR amendments:** when an ADR is bumped, fail if no code change accompanies in the same commit OR in a linked commit.
2. **Architect-dispatch verification step:** after the architect amends an ADR that prescribes code structure, the dispatch returns with a "implementation-side change required" callout that the orchestrator must route.
3. **Adversary pass with code-vs-spec lens:** the current adversary catches this AFTER the fact (via pass-1, pass-2 findings). A pre-impl audit specifically checking ADR-prescribed-code-structure vs actual-code would catch faster.

## Reproduction

Switchboard-blue session `b8690230-7b5d-4e57-b71c-8b9ffeee3d9a`. S-3.04 development.
- ADR-009 v1.5 minted at `e6aa5ba`.
- v1.5 → v1.6 amendment at `c92cbb7`.
- Pass-1 M-1 fix at `15353b1` (comment update only).
- Pass-2 M-1 fix at `e99bcf2` (finally added the defensive copy).
- Adversary reports: `.factory/cycles/cycle-1/S-3.04/adversary/pass-01.md`, `pass-02.md`.

## Related (this batch)

- drbothen/vsdd-factory#272 — P19: architect hallucinated internal/ packages
- drbothen/vsdd-factory#273 — P20: parallel agent burst commit co-mingling