docs(retention): retire the list premise both retention gates state

[argszero]

Summary

Two module docs state a premise that #406 retired, as if it were still true today.

The premise: the transactions pagination list needs per-row identity (id/counterpart), the roll-up has none, therefore the list can always only be answered from the detail table. #406 moved the list onto the tx_facts read model (roll-ups ∪ unfolded tail), and counterpart is not in the payload at all, so the premise no longer holds.

The evidence that it was retired deliberately is already in this repository:

• feat(rollup): keep ten minutes of transaction detail by default #407's own commit message says its premise "was exactly what feat(transactions): serve the transactions list from the tx_facts read model #406 removed".
• ui/README.md, written by feat(rollup): keep ten minutes of transaction detail by default #407, calls it the premise that disappeared this round.

Neither of those commits updated the module docs that state it, so both still assert it in the present tense:

• src/tx_retention_gate.rs:6-7 opens the rule list with it — the file argues from a premise that its own bullet, ten lines later, says is gone.
• src/usage_retention_gate.rs:4-5 reasons across files from it, and names the rule wrong as well: it says "the window must cover every preset the list itself offers", which feat(rollup): keep ten minutes of transaction detail by default #407 rewrote into two halves (the window must be expressible in minutes, or the list no longer reads the detail table).

Both sentences now say what holds today: the window must be expressible in minutes, and the history outside it is carried by the minute roll-ups.

Related Issue

None.

Changes

• src/tx_retention_gate.rs — the premise sentence is marked as the former premise, with a pointer to the acceptance item that retired it (feat(transactions): serve the transactions list from the tx_facts read model #406).
• src/usage_retention_gate.rs — the cross-file sentence now states the reason that holds and how the outside-window history is carried.
• Config/data-structure changes synced to the example files — not applicable.

Comments only: no behaviour, no gate rule, no config, no cache-bust token.

Tests

• cargo test — 562 passed, 0 failed (identical to the base tree)
• cargo fmt --check — clean
• cargo clippy --all-targets -- -D warnings — rc=0
• New tests added — not applicable. These are prose claims about what the code currently does; no gate reads either module doc as corpus (checked), and this repository's settled practice for such a claim is to correct the text rather than to add a gate.

Checklist

• Branch named per the convention (docs/...)
• Commit message uses Conventional Commits
• Single responsibility, minimal change