Accepts two 0.7.0 amendments at 1fcb204

[johnnyt]

Flips two amendments whose code shipped in encryptor_ecto 0.7.0 from proposed to accepted, one per record, each with a dated foot Note. Docs only (docs/adr/); no changelog fragment, and no quality gate applies (the repo's docs-only rule: a change touching no Elixir code has no gate to run).

Every claim was re-verified against main at 1fcb204, the commit tagged v0.7.0 and published on Hex as 0.7.0.

ADR-0004, "Amendment (2026-09-29): a from: of this package's own type that declares legacy: is not silent". Code half: the **Breaking** entry of the [0.7.0] changelog section. Claims checked: :legacy is among the keys frozen_params?/1 requires (Encryptor.Ecto.Migrator.Source), so vault_backed?/2 still answers true for a declaration with legacy:; source_authenticated!/4 returns a declared boolean as declared, and undeclared_source!/3 raises a CompileError through raise_at!/2 naming the field, the from: type and the legacy: module (undeclared_legacy_message/3); a vault-backed from: naming no legacy: module still compiles silent; vault_backed?/2 changed in its doc only and @field_options is unchanged between v0.6.0 and v0.7.0; the exit guide's section "If you must go back: the reverse plan" and Encryptor.Ecto.Binary's moduledoc section "The migration window: :legacy" exist; the three tests the Note names are in test/encryptor/ecto/migration_test.exs.

ADR-0005, "Amendment B (2026-09-29): :root_vault is required only when :gcp_kms is absent". Code half: the Added entry of the [0.7.0] changelog section. Claims checked, also against encryptor v0.6.0 (91e9643), the version 0.7.0 pins: root_vault/1 (Encryptor.Ecto.KeyStore) answers {:ok, nil} only when :root_vault is absent and :gcp_kms present, otherwise module_option/2 refuses as before; the state/0 type reads root_vault: module() | nil; the %{root_vault: nil} clause of unwrap_row/4 answers {:invalid_key_descriptor, {:no_root_vault, "engine_message"}} for a row with no key_id, and a row carrying one still answers :unexpected_key_id; t:Encryptor.Provider.reason/0 carries {:invalid_key_descriptor, term()}, so nothing widens; the root vault is read by unwrap_row/4 alone once placed in the state; the shipping commit changes no stored string; the named describe blocks are in the two key-store test files.

Shape. Each Amendment's Status word flips in place, as the earlier flips in these records did (ADR-0005's Amendment A). Each foot Note closes with its provenance line. The index table is unchanged (both rows already read "with amendments"); a paragraph naming the two amendments follows the precedent paragraph for the 0.6.0 flips. git diff origin/main -- docs/adr/ removes exactly the two Status lines.

Review. In-turn review against the bead's acceptance: every claim above was read at the anchor named, the removed-line count checked, and each Amendment's own "no status word above flips" sentence is met in its foot Note rather than reworded. The cold direction pass is still to run.

Refs: ece-vvez