Get answers to pre-traversal questions in section 3.15.

Per-file change manifest:

- 1917-embed-cli-runtime-ignorance-reduction-plan.md: Fix C ABI entry point
  count from ~12 to 5. Correct signatures to match merged .NET PR #1901.
  Add conditional-instantiation constraint to 3.4. Add key design principle
  to 3.5 (subprocess default, FfiRuntimeHost parallel to CliServerManager).
  Add dual-transport E2E question to 3.11. Add TDD discipline section to
  Phase 4 with 7 rules (test-first, gating, coverage, isolation).

- adr-007-native-bundling-strategy.md: Replace approximate 12 entry point
  claim with exact 5 entry points table showing full C signatures, parameter
  semantics, and outbound callback signature.

- supply-chain-security-to-stephentoub.md: New file. Note for Stephen Toub
  documenting that all non-Java SDKs download @github/copilot-{platform}
  tarballs directly from registry.npmjs.org at build time, with mitigations
  inventory.

Author: edburns