feat: phase 8 serviceadapter crd rollout (32/33 tasks)

docs/API-sqs.md

@@ -219,8 +219,7 @@ and the REST surface is mounted with the in-process grpc-gateway variant that by
 gRPC interceptors regardless. Both `:8080` and `:9090` are currently open, and
 `kmsvc.riotpiao.com` is publicly routed.
 
-The gateway is therefore the only authentication boundary for this surface. See
-[KNOWN-ISSUES.md](KNOWN-ISSUES.md) §2.
+The gateway is therefore the only authentication boundary for this surface.
 
 ---
 
@@ -230,7 +229,7 @@ The gateway is therefore the only authentication boundary for this surface. See
   and grep for `ExecuteWorkflow`/`StartWorkflow` across `kmsvc-manage`, `kmsvc-sdk` and
   `kmsvc-cli` returns nothing. A caller dials `temporal-frontend.temporal.svc:7233`
   with a Temporal SDK directly. A `/workflow/*` surface is net-new code, not a proxy
-  route — see [task 7.3](../tasks/7.3-workflow-prefix.md) and KNOWN-ISSUES.md §1.
+  route — see [task 7.3](../tasks/7.3-workflow-prefix.md).
 - **DLQ operations.** `kmsvc-cli`'s `dlq peek` and `dlq redrive` are client-side
   compositions of the six RPCs, not server operations. Redrive is a non-atomic
   Receive-Send-Delete. If `/sqs/*` should offer redrive, that is new logic with real