docs(frost): record batch signing as built, and what rollout needs

Phase 7 of docs/frost-batch-signing.md, which is the phase with no code in it.

Nothing needs a feature flag. k=1 is the entire behaviour of the app as shipped
-- no caller batches anything yet -- and at k=1 every message is byte-identical
to the app before Phase 1: encodeProposal returns the bare event object,
joinPayload of one value is that value, and every plural branch in the
transcript is only taken above one. The doc now tabulates that rather than
asserting it in prose, since it is the claim the whole rollout rests on.

The one rollout constraint stands: before a caller batches, the group has to be
on a build that understands array proposals. There is no negotiation for it and
adding one is not worth it -- an old device refuses an array proposal outright,
so the failure mode is a batch that never reaches threshold and is abandoned,
visible in the transcript and costing a retry.

Also records what is left, which is nothing in the protocol: deciding what to
batch is a product question, bounded only by "a batch is only as available as
its worst item" and "GroupKeyStateManager.propose must never batch".

The phases are kept as written rather than rewritten into a description of the
result -- the code reads better against the argument it came from -- with the
two places the implementation chose differently (itemIndex over index,
DROP COLUMN over a table rebuild) marked in their own sections.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/README.md

@@ -20,6 +20,6 @@ Start with the ceremony if you are new to this area; the Marmot notes all assume
 Read the skipped-keys note before debugging any "the other device never got it"
 report — it is silent, and it looks like every other kind of delivery failure. The
 sync note stands alone, and the dead-code inventory reads as a follow-up to it. The
-batch-signing note is a plan rather than a description of what is there: read it
-after the derivation note, whose one rule is the same one it is built around. The
+batch-signing note is a phased plan that has been built: read it after the
+derivation note, whose one rule is the same one it is built around. The
 jvm-target note is unrelated to all of them: it is a build and packaging story.