Decide whether to publish a cache / rate-limiter port

Moved off `roadmap.md`'s *Published Contract Candidates* table, where the verdict was **Probably, later**.

In-memory and Redis are two genuine implementations, and the Security Baseline needs the limiter regardless. But cache interfaces leak badly — TTL semantics, invalidation, bytes vs. typed values — so this needs its own design pass rather than extraction from whatever ships first.

Not a "write the port" task yet: the deliverable is the design pass that decides the shape, or decides it stays internal.

Related: the Security Baseline needs an in-process limiter regardless of this decision, and Pack D adds the distributed/Redis-backed one.

Start by reading roadmap.md and the issue's references to the Security Baseline and Pack D. Compare the stated in-memory and Redis implementations while focusing on TTL semantics, invalidation, and bytes versus typed values. Done means documenting the proposed interface shape or the decision to keep the cache internal.

Written by the indexing model from the issue text.