fix review findings: stale abort() docs + move RFC to implemented

Codex's no-ship was a completeness/docs-sync gap, not loop behavior:

- docs/architecture.md: drop the public abort() handle row; the teardown
  signal is now cancel() then await whenIdle().
- cancel.spec.ts: the module doc and the turn-start comment contrasted
  cancel() against a public abort() verb that no longer exists — reword to
  name the loop's private step AbortController.
- packages/ui/acp/src/index.ts: the post-resume-leak comment cited abort();
  cancel() is the surviving stop verb that likewise does not unregister.
- Move the RFC proposed -> implemented/simplification with amended text:
  Status flips, the both-removal proposal is narrowed to abort-only, and an
  implementation note records why whenIdle() is retained (load-bearing
  quiescence primitive with live ACP consumers). Update docs/rfc/README.md.
- AGENTS.md "RFCs are proposals, not golden truth": add the concrete
  abort/whenIdle worked example now that the implemented RFC exists to link.
- Regenerate the cordis catalog (line-number drift from the rebase).

packages/ui/acp/src/index.ts

@@ -488,7 +488,7 @@ export function apply(ctx: Context, config: AcpConfig): void {
           // Validate the PERSISTED cwd BEFORE resuming — `list()` is a
           // metadata-only read (no full-log parse), so this rejects a session we
           // can't honor WITHOUT ever constructing/registering an agent (a
-          // post-resume reject would leak the registered agent — abort() does not
+          // post-resume reject would leak the registered agent — cancel() does not
           // unregister it — and wedge the id against re-load). The session's bash
           // workdir is derived from its persisted `header.cwd` and the request
           // `cwd` does NOT override it (resume takes no cwd), so a session with no