arch(stable-replaceable): document Tier STABLE CORE / REPLACEABLE SURFACE segmentation

[Argocyte]

Document the STABLE CORE / REPLACEABLE SURFACE architectural principle in project_lunarpunk_architecture.md and/or an ADR. No replaceable-surface component may hold load-bearing logic for any stable-core component. Cooperative-tech ecosystem adoptions are replaceable surface by default. With addendum: small resource allocation for maintaining replaceable surfaces + long-term federated development engine vision. Consented AGM 2026-04-12 (A9/P1). Red-team source: red-team-bonfire-federation-tensions.md. Filed by Et under G5.

[Argocyte]

Update: Iskander-Code implements Tier STABLE CORE

Stable Core components in Iskander-Code:

• Facilitator algorithm — deterministic S3 state machine (not AI, not replaceable)
• Glass Box gate — structural invariant Feature/genesis boot sequence — complete implementation #1 (unconditional, not configurable)
• Scoped executor — domain boundary enforcement (constitutional, not hookable)
• Constitutional hierarchy — 4 layers loaded from docs/constitution/
• SOUL.md identity — agent identity (pure: name, role, principle)

Replaceable Surface:

• LLM provider (configurable in cooperative-identity.toml — Claude/OpenAI/Ollama/any)
• Model selection per tier (S3 agreement with review datetime)
• Specific agents (spawn/retire organically via researcher)
• Skills in knowledge commons (versionioned, weighted by value)
• Interface (CLI now, web/TUI later)

Model defaults now load from cooperative-identity.toml [models] section instead of being hardcoded. Provider endpoint also configurable (for self-hosted Ollama etc.).