Callback ingress as a deployable: `awa callbacks serve` + promote ADR-027 to Accepted

## Motivation

ADR-027 (Proposed) defines the surface split: private admin UI/API, public **signed** callback receiver, internal workers, internal maintenance. The callback-only router and user-owned callback layers already shipped (#291/#293) — what's missing is the last mile: a dedicated process entrypoint so operators can expose callbacks publicly without carrying the admin UI, its assets, or its CORS posture in the same binary surface.

## Scope

- `awa callbacks serve` — the callback receiver as its own process: the #291/#293 router, BLAKE3 signature verification, configurable URL prefix, **no** admin routes, **no** UI assets, minimal dependency surface.
- Health endpoints (from the worker-health issue) on this process.
- Promote ADR-027 from Proposed to **Accepted**, with the surface-taxonomy table as normative documentation.
- End-to-end reference topology docs: public ingress → callback receiver; private network → admin UI; Helm values for the optional callback-ingress Deployment (feeds #344).

## Acceptance

- A public-ingress deployment is documented and installable end-to-end; the admin UI is reachable only privately in the reference topology.
- Callback signature verification, error mapping, and payload contract identical between embedded router and standalone process (shared code, contract-tested).
- ADR-027 status updated; `docs/security.md` reflects the four-surface model.

## References

Roadmap: `docs/0.7-roadmap.md` (D3, WS-3, NEW-8). Related: ADR-027, ADR-018, ADR-021, #291, #293, #282, #344, #343.

Start with ADR-027, docs/security.md, and the related references to #291 and #293 to understand the existing callback surfaces and their contract. Review the roadmap entry in docs/0.7-roadmap.md and the worker-health issue before tracing the deployment and Helm requirements. Done means the standalone ingress, health endpoints, shared contract behavior, accepted ADR, and end-to-end topology documentation all meet the stated acceptance criteria.

Written by the indexing model from the issue text.