feat(k1): wire dormant control lease

plugins/xgrids-k1/README.md

@@ -31,6 +31,8 @@ The plugin owns:
 - K1-specific operator instructions and compatibility tests.
 - the scoped React `device.connection` contribution and its BLE/Wi-Fi and
   acquisition pipeline UI.
+- the dormant application-control facade boundary: explicit shadow arm/disarm,
+  a 15–300 second Keychain-backed in-memory authority lease, and redacted state.
 
 The plugin does not own:
 
@@ -79,6 +81,12 @@ device I/O with:
 uv run python plugins/xgrids-k1/profile_loader.py
 ```
 
+Plugin v0.4.0 does not widen device authority. Its application-control
+coordinator has no request-emission method, no live MQTT sink and no UI control;
+`vendor_writes_enabled` remains false. Keychain item provisioning and a separate
+review of any future write-capable transport are still required before a
+physical command can be considered.
+
 The optional owner-controlled iPhone/LixelGO observation tool lives under
 [`lab/iphone-capture/`](lab/iphone-capture/). It pins `pymobiledevice3` in a
 separate `uv` environment, writes only ignored evidence sessions, and remains a