Document breaking admission change from Access validation

Follow-up from #47.

#47 added a webhook rule rejecting LLMModel CRs where Access.Public is not true and Access.Groups is empty. The PR body framed this as a narrow invariant for the new internal authorization block, but the rule fires on every CR regardless of whether the internal endpoint is enabled. Any existing manifest that omitted Access entirely now fails admission.

This is an intentional tightening, but it is a breaking change that is not called out in any user-visible place.

Asks

• Add a section to docs/design.md (or README.md) consolidating the admission rules the webhook enforces: managed-namespace label, subdomain length, subdomain collision, and the new access rule.
• Add a CHANGELOG entry (or equivalent release-notes file) for the next release noting the new required field combination and the error message.
• Consider whether to narrow the rule to only fail when endpoints.internal.enabled is true; keeping it broad is safer but should be a deliberate call.

Read issue #47 and inspect the webhook implementation to verify the managed-namespace, subdomain, collision, and access rules and their error message. Update docs/design.md or README.md with the consolidated rules, then add the breaking access requirement to the changelog or release notes. Document the decision about whether the rule applies only when the internal endpoint is enabled.