docs: reconcile private workbook child authorization notes

[audreyt]

Summary

Reconciliation after a shipped fix (PR #850 / merge c0ba9b3), not new runtime behaviour. Production already runs parent-derived child authorization via immutable meta:parent. These docs and one client-multi test still described the pre-fix world.

What changed

• AGENTS.md decision fix dotcloud deployment #14 — distinguishes RoomDO as the sole authz enforcement boundary from where the verdict originates: top-level rooms use local meta:access/meta:acl; parented workbook children derive the parent's verdict via immutable meta:parent (parent RoomDO authoritative via /_do/access, fail-closed; parent marker + local ACL → deny).
• Changes.txt — had an outright false Unreleased claim that multi-sheet import is unavailable for private rooms (HTTP 409 because sub-sheets would publish as public). That limitation was removed by the ship that closed the exposure. Corrected to “re-enabled for private rooms” with meta:parent inheritance. The existing meta:parent security bullet now names the confidentiality exposure it closed and records that operator backfill has not been run.
• API.md — private-parent multi-sheet import support was already documented in 68dcce9; adds the same operator-backfill residual (pre-fix unmarked children stay world-readable until processed; private parents absent from the rooms index so inventory is incomplete).
• packages/client-multi/test/importWorkbook.test.ts — asserted a 409 body the server can no longer emit, under a name claiming a private-room refusal that no longer exists. Replaced with the live DO-skew 503 body (PARENTED_CHILD_DO_SKEW_MESSAGE from packages/worker/src/routes/multi-import.ts) and renamed to what it actually pins (server status + body surfaced in the import failure alert). The existing 413 cell-cap and 500 body-read-fallback cases are preserved — the contract got broader, not thinner. Coverage remains 100% on all four metrics.

Deliberately left alone

• packages/worker/src/lib/authorize.ts keeping “absent ⇒ public” is correct for that function — its contract did not change; the parent hop lives above it in RoomDO #effectiveAccess.
• packages/client-multi/src/importWorkbook.ts:40-45 is past tense describing real history (direct sub-room PUT used to mint a public child), not a stale product claim.
• _formdata private refusals in packages/worker/src/routes/assets.ts and packages/worker/src/lib/ws-handlers.ts remain true and were explicitly out of scope for parent inheritance — they should stay.
• docs/UI_BACKLOG_843.md is not on main (only on docs/issue-843-assessment); content is issue Suggested UI fixes (with sample from legacy EtherCalc version) #843 UI assessment, not this confidentiality fix.
• docs/migration/PROD_UPGRADE_PLAN.md has no private-import-409 or “ACL inheritance deferred” claim. §4 Step 3c (atomic 100% for new /_do/* RPCs) is current ops truth from the append-import split incident.

Test plan

• vp run @ethercalc/client-multi#test:coverage — 148/148, 100% statements/branches/functions/lines
• vp run @ethercalc/client-multi#typecheck
• vp lint
• CI green on this PR (watch after open)

No deploy — docs + test fixture only; runtime behaviour unchanged.