Repoint ADR references after HQ consolidated 65 records to 23

96 comments across the two repos named records that no longer exist. Each now
points at the consolidated record that holds its reasoning -- ADR 0034 (a test
defends a decision) is 0017, the eight host records are 0005, the four lab
records are 0016.

Worth noting for next time: these are references from outside HQ, so renumbering
there is not free. It cost 38 files here.

internal/system/android.go

@@ -13,7 +13,7 @@ import (
 // way to run something — and refuses the other three. That is not a broken host: a declaration
 // naming a shape this host does not implement is refused whole, the same treatment an unknown
 // type gets, and the profile tells the control plane which shapes exist so it never sends one
-// it cannot do (novox/hq ADR 0060).
+// it cannot do (novox/hq ADR 0005).
 //
 // What it cannot do, and why:
 //
@@ -24,13 +24,13 @@ import (
 //     and an unlocked bootloader. On a normal device nothing can register with it.
 //   - **container** — no container runtime, and no kernel access to give one.
 //
-// **This host is EPISODIC** (novox/hq ADR 0062). Everywhere else an init runs the launcher at
+// **This host is EPISODIC** (novox/hq ADR 0005). Everywhere else an init runs the launcher at
 // boot and the launcher supervises the host. Android grants neither: nothing to register with
 // without root, and nothing worth supervising, because a supervisor would be killed alongside
 // what it supervises.
 //
 // So it runs when the platform allows and is killed when the platform wants the memory — and
-// that is **disconnection**, which ADR 0036 already made an ordinary situation rather than an
+// that is **disconnection**, which ADR 0004 already made an ordinary situation rather than an
 // exception. It needs no keep-alive and no new mechanism: the store is already authoritative
 // while disconnected, reconcile already happens on start, and the mesh already reports *last
 // heard from* rather than alarming on silence.