chore(plugin-auth): anchor auth-manager-membership-admission.ts to ADR-0093

The membership reconciler's single assembly of its inputs,
settleMembership, moved into auth-manager-membership-admission.ts in an
earlier cut, but the ADR-0093 D2 invariant that governs it stayed
anchored only on auth-manager.ts and auth-manager-database-hooks.ts. A
new scripts/adr-anchors entry carries that paragraph verbatim for the
module, and one comment-only paragraph in the module header names the
decision, so check-adr-anchors can hold the reference there. No code
changes.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LSXBc2GCBwiAL7vV4kWkyr

Author: claude

packages/plugins/plugin-auth/src/auth-manager-membership-admission.ts

@@ -45,6 +45,12 @@
  * while they are first evaluated: this module's top level is imports, an
  * interface and function declarations.
  *
+ * `settleMembership` below is governed by ADR-0093 D2: the membership
+ * reconciler is the single owner of the "every user gets a membership"
+ * invariant, and this is the manager's single assembly of its inputs, which
+ * both creation seams call. `scripts/adr-anchors/` carries the invariant for
+ * this file, as it does for `auth-manager.ts`.
+ *
  * Nothing re-exports this module, so the published surface does not move.
  */
 

scripts/adr-anchors/packages__plugins__plugin-auth__src__auth-manager-membership-admission.ts.json

@@ -0,0 +1,7 @@
+{
+  "file": "packages/plugins/plugin-auth/src/auth-manager-membership-admission.ts",
+  "adrs": [
+    "ADR-0093"
+  ],
+  "invariant": "ADR-0093 D2 — the membership reconciler is the SINGLE owner of the \"every user gets a membership\" invariant, and `settleMembership` is this manager's single assembly of its inputs. TWO seams call it and must never disagree: `user.create.after` (the creation seam every path flows through — email signup, admin create-user, bulk import, SSO JIT, none of which need a session) and `session.create.before` (which settles BEFORE resolving the session's active organization, so a user's first session is not minted tenant-less — #8245). Assembling the deps per call site would let them drift on the policy, which is a live platform setting read through `getMembershipPolicy()` (#5152): a captured option leaves one seam auto-binding after an admin switched the deployment to `invite-only`. The session-seam call must also stay a pure ORDERING change — same reconciler, same policy, same target-org resolution — so `invite-only` and multi-org still bind nobody and those sessions still mint with no active organization, which is the legal state the #8247 ruling declares."
+}