ADR-004: composable reins as middleware stays deferred (GLAS-WP-0002-T01)

Checked ADR-002 part 2's deferred question against the two observability
additions that landed since (rein-aharness's tool-event stream,
glas-harness's own gateway hub event) -- both turned out simpler as
direct implementations, neither needed a wrapping middleware layer.
Still zero real candidates for that shape. docs/harness-contract.md
gains the Middleware ABC as a documented, unimplemented sketch for if a
real third case ever appears -- no code written now.

Also flagged GLAS-WP-0002-T02 (live OpenBao verification) as blocked:
`bao token lookup` from this workstation returns 403, no usable vault
session to provision a new AppRole with. Needs the operator.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/adr/ADR-002-credential-brokering-and-composable-reins.md

@@ -75,7 +75,13 @@ repeats the same need — decide from evidence, not in advance.
 - `GLAS-WP-0001-T06` is done. `GLAS-WP-0001-T05` (bootstrap
   `rein-openweights`) is unblocked.
 
-## Part 2 — open, deferred: composable reins as middleware
+## Part 2 — resolved in ADR-004: composable reins stay deferred
+
+See `docs/adr/ADR-004-composable-reins-stay-deferred.md` — the deferral
+below held even after two more observability additions landed; both
+turned out simpler as direct implementations, not middleware.
+
+## Part 2 (original framing, for context)
 
 Separately, the idea surfaced that monitoring/evaluation/optimization
 (capabilities `llm-connect` already stages as optional Functional