Approve spec 067: durable journal retention and write-path limits

[enricopiovesan]

Summary

• Issue Permanence: Durable event journal beyond in-memory retention window (spec 036) #593 was blocked pending a spec amendment to 036-event-subscription-replay covering durable event journal permanence. 066-durable-identity-event-delivery (approved via docs: record blocker-resolution architecture decisions #631) already answered most of Permanence: Durable event journal beyond in-memory retention window (spec 036) #593's Definition of Done, but left two operational questions open: how expired journal data is physically reclaimed, and what publish() does when a durable write stalls.
• This PR approves 067-durable-journal-retention-and-write-limits, a narrow amendment closing those two gaps, decided via a structured brainstorm session:
  • Retention/pruning: whole-segment deletion once every event in a segment ages out (no in-place compaction — matches spec 066's own "no pluggable storage abstraction in the first implementation" stance), with a required segment rollover cap (max size or max duration, whichever first) so a single old event can't pin newer sibling events past the nominal retention window indefinitely.
  • Write-path stalls: publish() waits up to a configured timeout for the durable write to complete, then hard-fails with a distinct journal_write_timeout error (event rejected, not silently downgraded to in-memory-only delivery) and a structured audit event, rather than blocking indefinitely.
• Recorded as ADR-0006 and Decision 17 in the decision log, matching the existing style used for specs 063-066.
• Updated issue Permanence: Durable event journal beyond in-memory retention window (spec 036) #593: relabeled needs-spec/blocked/future → no-spec-needed and moved to Project 1 Ready, matching how sibling issue Security: Propagate subject_id/actor_id into TraverseEvent envelopes and subscription filters (spec 030 FR-006/016) #591 was unblocked from the same spec cluster (the issue itself now carries the implementation work directly rather than spinning off a separate ticket).

Governing Spec

• 004-spec-alignment-gate
• 065-sigstore-bundle-verification
• 067-durable-journal-retention-and-write-limits

Project Item

Relates to #593 (spec-definition Definition of Done now satisfied; implementation is tracked under #593 itself, now Ready)

Validation

• jq empty specs/governance/approved-specs.json — valid JSON.
• bash scripts/ci/spec_alignment_check.sh — passes locally against this branch.
• bash scripts/ci/pr_body_check.sh — passes locally against this PR body.
• No source code changed; no test/coverage/clippy impact.