docs(authzen): commit to the end-user subject at v11, matching this file's own table

[saurabhjain1592]

Closes the part of getaxonflow/axonflow-enterprise#3902 that is live on this repository's default branch.

The defect

This file contradicted itself, 23 lines apart.

The mapping table COMMITS (docs/AUTHZEN_MIGRATION_DRAFT.md, ## Field-by-field):

| an end-user subject | not yet | the identity plane that can resolve and bind one activates at v11. … |

The prose 23 lines later RETRACTED it (## What has not been decided):

• Whether an end-user subject becomes available at v11 or later, and what the identity plane requires of a caller to bind one.

A reader who found the table planned for v11. A reader who found the list did not. Both were reading the same file.

Across the five published SDKs the split was 3–2: axonflow-sdk-go, -python and -typescript commit in every location they mention it; this repository and axonflow-sdk-rust commit in the table and hedge in the prose. An operator ruling was requested on 2026-09-01 and never given, and because three SDKs already told customers it was committed, the status quo was not neutral — it was three customers planning for v11 and two told not to.

The fix

The hedging bullet is removed and this file gains the ## Not yet expressible section the other three already carry, with the identical sentence:

It arrives with the identity plane at v11.

Verified: all five repositories now contain that sentence exactly once, and the string becomes available at v11 or later appears in none of them.

The sentence is language-adjusted only where it names a symbol (AuthZENSubject.type / AuthZenSubject.r#type, userToken / user_token), which is what the three committing SDKs already do among themselves.

Two smaller things this change also does

• None of these → This. Removing the bullet left one item under ## What has not been decided, and its closing sentence still read as a plural.
• The new section states its own deletion condition. -go, -python and -typescript each carry a ## Checklist for the v11 release train with an item that says to delete this section when the subject ships. This repository has no checklist section at all, so an inline revisit condition takes its place rather than inventing a checklist here.

What this change does NOT do, stated so nobody infers it

No wire change, and none was needed. All five SDKs were checked: none has an end-user/subject/principal field on the POST /api/v1/decide request, all five emit the identical envelope (stage, query, caller_identity, target, user_token, context), and caller_identity is a gateway identity throughout. The divergence was purely in what the five repositories told customers, which is why this is a documentation change and not a type change.

The durable check asked for by #3902 — something that fails when the five repositories diverge on a shared commitment again — is not in this PR and is not something a single repository can hold. It is reported back with this change.