docs(adr): renumber the second ADR-0041 to 0042, and re-count the README

[Gerrrt]

main is red on its own, and every open PR inherits it. make check-docs
reports three disagreements that no open PR introduced:

README.md:95 claims 41 ADRs; the repository has 42
README.md:96 claims 26 runbooks; the repository has 27
ADR-0041 is claimed by 2 files: 0041-run-the-crs326-..., 0041-terminate-the-remote-path-...
  — renumber the one that landed second

Two sessions took the same ADR number, 56 seconds apart

Merged	PR	ADR-0041
2026-09-17 16:27:56	#491	the CRS326 on RouterOS
2026-09-17 16:28:52	#495	terminate the remote path

check_docs.py says to renumber the one that landed second, so the
remote-path ADR becomes ADR-0042 and the CRS326 one keeps 0041.

On renaming an ADR at all. ADR-0001 makes them immutable, and normally that
settles it. But immutability protects a decision's content and its identity,
and this identity was never unique — two files answering to one number is the
defect being repaired, not a decision being revised. No text inside either ADR
changed; only the filename, the title line and inbound links.

The bare mentions had to be split by hand

A global replace would have been wrong: ADR-0041 appears in prose on both
sides of the collision.

• Stay 0041 (the CRS326): swap-the-switch.md ×5, hardware.md, ADR-0018,
  and one link label in roadmap.md.
• Move to 0042 (the tunnel): open-the-remote-path.md,
  restore-the-firewall.md, ADR-0008, ADR-0011, ADR-0014, ADR-0022,
  network.md, observability.md, security.md, and roadmap's other mention.

roadmap.md is the only file citing both, so it was edited surgically rather
than swept.

Three of the moved mentions are firewall rule descriptions in
open-the-remote-path.md — `WireGuard peers — ADR-0041`. Safe to change
because the tunnel does not exist: #436's jumpbox has not been built, so no
live rule on morpheus carries that string yet. Had it been built, this would
have needed a rule edit rather than a document edit.

Left alone deliberately

README.md:210 still says "39 architecture decision records". It is wrong
too, but check_docs.py's counted-claims pattern only matches {COUNT} ADRs,
so line 210 is unguarded and has been drifting silently for longer. Fixing the
number without fixing the blind spot would just hide it again — worth its own
issue.

Verification

make check-docs and make lint both pass on this branch. Found while
resolving a merge conflict on #501; kept separate from it so the NAS work is
not tangled with an ADR renumber.

🤖 Generated with Claude Code

[Gerrrt]

Duplicate. Closing in favour of
#503, which was opened 90 minutes
earlier.

Three sessions independently produced this fix — #503 at 23:36:31Z, #504 at
23:37:07Z, this one at 01:05:22Z — and all three are byte-identical: the
same 12 files, the same +27/−27, and the same 54 content lines once blob hashes
and hunk offsets are set aside. Same renumber of the remote-path ADR to 0042,
same split of the bare ADR-0041 mentions between the tunnel and the CRS326,
same two README counts. All three are green and mergeable.

That three sessions each spent a full run on the same 54 lines is the finding
worth keeping, not the diff. A red main is visible to every session at once,
so every session picks it up at once; the collision is structural rather than
anybody's mistake.

For whoever lands #503: it is the earliest and is mergeable=clean with all
three checks passing. #504 is the
other duplicate and wants closing too — left alone here rather than closing
another session's PR unasked.

Context this was found from: main has been red since the two ADR-0041 files
landed 56 seconds apart on 2026-09-17, and every open PR inherits the three
check-docs disagreements — including
#501, whose only failing check is
exactly these three lines and nothing of its own.