docs(adr): make the 0158 TLS update non-perishable

The correction I added said 093db33 (#132) left alert_sinks.py as "the only
remaining instance on main". That is a checklist-shaped claim with an expiry
date: BACKLOG #323 layer 3 (PR #142) closes the alerts call site, and the
sentence goes false the moment it lands. Dating the observation does not help a
reader who greps for it in a month and finds nothing.

Restated as what happened rather than what is currently true -- #132 closed the
two connectors, the alerts call site is tracked as #323 layer 3 -- so it holds
whether or not #142 merges, and it says outright that the current state must be
grepped rather than cited from here.

Deliberately does NOT assert that #142 closed the cell: #142 is open at time of
writing, and asserting a merge that has not happened is the same defect pointing
the other way.

found by: the repo-security-review session, which owns #142 and re-derived all
three call sites against origin/main before raising it.

Author: wshallwshall

docs/adr/0158-silent-controls-green-signals-that-mean-nothing-and-shape-over-detection.md

@@ -170,8 +170,10 @@ been killed" is a counterfactual about a run that never faced them.
   argument ([`alert_sinks.py`](../../messagefoundry/pipeline/alert_sinks.py):382-384). The same bare
   call stood at [`transports/email.py`](../../messagefoundry/transports/email.py) and
   [`transports/direct.py`](../../messagefoundry/transports/direct.py) when this was written; *update
-  (2026-08-02, after this ADR was committed): 093db339 (#132) gave both an explicit verifying context,
-  leaving the alert sink as the only remaining instance on `main`.* On the project's own
+  (after this ADR was committed): 093db339 (#132) gave both connectors an explicit verifying context,
+  and the alerts call site is tracked separately as BACKLOG #323 layer 3. This instance is recorded
+  because it is the worked example the taxonomy was derived from, not as a statement of what is
+  outstanding now -- a reader wanting the current state must grep, not cite this.* On the project's own
   interpreter (Python 3.14.6), `smtplib.SMTP.starttls` resolves a `None` context via
   `ssl._create_stdlib_context`, which **is** `ssl._create_unverified_context`: `verify_mode`
   CERT_NONE, `check_hostname` False. The sink encrypts and authenticates nothing. **A retraction is