Repoint ADR references after HQ consolidated 65 records to 23

96 comments across the two repos named records that no longer exist. Each now
points at the consolidated record that holds its reasoning -- ADR 0034 (a test
defends a decision) is 0017, the eight host records are 0005, the four lab
records are 0016.

Worth noting for next time: these are references from outside HQ, so renumbering
there is not free. It cost 38 files here.

internal/declaration/declaration_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 )
 
-// Each test names the decision it defends (novox/hq ADR 0034). The decision here is ADR 0043,
+// Each test names the decision it defends (novox/hq ADR 0017). The decision here is ADR 0005,
 // and the property it turns on is that unknown is REFUSED, never skipped.
 
 func valid() string {
@@ -160,7 +160,7 @@ func TestAnEmptyDeclarationIsAMistake(t *testing.T) {
 // --- the vocabulary the substrate bootstrap needs (novox/hq 07-the-substrate.md) ---
 
 func TestAnActionOverTheLinkIsRefused(t *testing.T) {
-	// novox/hq ADR 0047. The link may push declarations of known shape and never a command to
+	// novox/hq ADR 0005. The link may push declarations of known shape and never a command to
 	// run. This is the boundary the whole security argument rests on, so it is asserted
 	// directly rather than inferred from the type list.
 	raw := []byte(`{"declaration":1,"resources":[
@@ -195,7 +195,7 @@ func TestAnActionWithoutVerifyIsRefused(t *testing.T) {
 }
 
 func TestAnImageMustBePinnedByDigest(t *testing.T) {
-	// novox/hq ADR 0046: reproducibility comes from pinning the identity of a thing. A bundle
+	// novox/hq ADR 0006: reproducibility comes from pinning the identity of a thing. A bundle
 	// naming a tag pins nothing — it names whatever that tag points at on the day it runs.
 	for _, image := range []string{
 		"postgres:17",