Order the records the way the system is learned

Jochen asked whether the order made sense. It did not -- it followed when
things happened to be decided, which after consolidation is fictional anyway
since record 5 alone folds decisions taken across a week.

Concretely wrong before: the domain statement sat at 8, after five engineering
rules; the constitution was scattered across 5, 12 and 17; the tiers landed at
15, 16, 21 and 22 with process records in between.

Now it walks: what the mesh is (1-3), its tiers from the bottom up (4-8), what
runs on them and how it gets there (9-10), how it is built (11-16), how it is
checked (17-18), how we work (19-23).

Two things made this safe rather than free. It is a permutation, not a
compaction, so the renames go through temporary names -- otherwise two files
want one slot and one is lost. And the reference rewrite is a single
simultaneous pass, because almost every number moved into a slot another number
was vacating; replacing one at a time would have cascaded and pointed things at
the wrong record while still resolving.

Verified: 284 [ADR NNNN](path) links across the repository, all with matching
text and target.

The ordering principle is now stated in 19 rather than left implicit -- the
repository already said "the numbering is the flow" about its folders, and
there was no reason for the records to be the exception.

00-META/README.md

@@ -34,7 +34,7 @@ comparing it against the code rather than by anyone noticing:
 
 - It described the pipeline as having a separate builder process and a build stage that
   packages. Neither was true after 2026-08-04; the documents stayed stale until 2026-08-06
-  ([ADR 0023](../02-DECISIONS/0023-delivery.md)).
+  ([ADR 0010](../02-DECISIONS/0010-delivery.md)).
 - It listed the mesh as spanning a fixed number of named machines, which is exactly the
   content this repository cannot carry.
 
@@ -44,10 +44,10 @@ symlinks at all — the rule is not merely "only the installer may link", and a
 elevating linking to a principle points the opposite way from where this is going.
 
 What exists today is that the installer owns and reconciles every link
-([ADR 0010](../02-DECISIONS/0010-the-mesh-creates-no-symlinks.md)) — an as-is fact, recorded in
+([ADR 0012](../02-DECISIONS/0012-the-mesh-creates-no-symlinks.md)) — an as-is fact, recorded in
 [`03-DESIGN/00-as-is/05-runtime-and-installation.md`](../03-DESIGN/00-as-is/05-runtime-and-installation.md).
 Centralising who may link narrowed the incident class; it did not close it. The intent is to
-remove the mechanism, recorded as [ADR 0010](../02-DECISIONS/0010-the-mesh-creates-no-symlinks.md).
+remove the mechanism, recorded as [ADR 0012](../02-DECISIONS/0012-the-mesh-creates-no-symlinks.md).
 
 A founding document contradicting the direction of travel is precisely the failure this folder
 exists to prevent.