Re-anchor docs/deviations.md and fix public TSDoc that contradicts the code #68

Part of the audit remediation umbrella #67. Milestone 1. Severity: MEDIUM (doc). No behavior change.

Current SDK behavior

Commit 1f48926 changed code that docs/deviations.md and several @public TSDoc blocks
describe. The register and the shipped .d.ts now state the opposite of what the code does.

docs/deviations.md:

• Item 5 (:164-166) quotes deserialize<T>(data, schema, typeName?) at serde.ts:145. The
  real signature is deserialize<T>(data: Uint8Array, target: DecodeTarget<T>): T at :192.
  The anchors serde.ts:182, json-serde.ts:236 and :242 do not point at the cited text.
• Item 17 (:411-425) says "classify.ts's cause-walk returns retryable for any IoError".
  Four of the five I/O leaves no longer extend IoError, so the claim holds for one leaf.
• The OBS-29 row (:440) says "The 1:1 binding is NOT met" and cites the old logging-step.ts
  lines. pipeline/runtime.ts:36-48,154-157 documents the binding as met.
• :429 says "Four rows as of 2026-09-02" above a five-row table.
• :441 says pipeline/ ships fifteen invariant( calls. Source has three.

TSDoc in the shipped .d.ts:

• packages/core/src/seams/serde.ts:165-171 (Deserializer) says top-level null rejection
  "cannot be conditional" and tristate(inner) is a field combinator only.
  DecodeTarget.admitsNull at :128-146 says a codec MUST honor the flag.
• packages/codec-json/src/json-serde.ts:267-272 (jsonSerde()) repeats the old text; line
  170 honors admitsNull.
• packages/core/src/context/instrumentation.ts:39-47 (tracerFactory) says it returns a
  started span. Every consumer casts the result to Tracer and calls .startSpan().
• packages/core/src/io/index.ts:14-16 says isIoError, AllocationLimitError,
  ClosedResourceError, SourceContractViolationError "remain internal". All four are on the
  barrel and in core.api.md.
• packages/core/src/http/request-conditions.ts:120-122 says HTTP-18 reconciliation "is left
  to a later phase". §10 item 15 decided it.
• packages/core/src/seams/operation.ts:161-164 (buildRequest @throws) omits
  RequestBodyNotAllowedError.
• packages/core/src/body/request-body-logging.ts:75 ends mid-sentence before @internal.
• packages/core/src/retry/retry-step.ts:67-73 says maxRetries admits Infinity, NaN
  and fractions. request-options.ts:213 rejects all three.
• packages/core/src/pagination/strategies.ts:57-58 says the template "never changes across
  the walk". paginator.ts:194-198 advances it. strategy.ts:10-11 is correct.
• packages/transport-conformance/src/run-suite.ts:4-5,314 claims TRANSPORT-22 coverage the
  suite does not drive.

Guides in docs/sdk-documentation/:

• write-a-response-handler.md:44-46: decodeSuccessResponse calls toHttpError only for
  4xx/5xx, and HttpStatusError has no headers accessor.
• write-a-paging-strategy.md:16-17,104-105: repeats the wrong template reading.
• auth.md:10-18: does not name RequestOptions.operationAuth as the operation tier source.

Expected behavior

Every file:line anchor in docs/deviations.md points at the text it cites. Every claim in
the register matches the code at the commit that changed it. Every @public TSDoc block
describes the behavior the code has. The three guides match the shipped functions.

Notes and leads

• Do this task first. Later subtasks change some of these lines again; a clean baseline makes
  those diffs reviewable.
• docs/deviations.md item 17 gets its final text after subtask 11 decides the instanceof IoError question. Re-anchor now; rewrite the rationale then.
• The OBS-29 row gets its final text after subtask 13. Mark it "in progress, see #…" now.
• Per CLAUDE.md, do not write counts into prose. Delete the "four rows" and "fifteen" numbers
  rather than correct them.
• After any TSDoc change: bun run build, cd packages/<pkg> && bun run api:local, commit the
  regenerated etc/*.api.md. bun run api must pass.
• node .claude/skills/housekeeping/probe.mjs and check-fences.mjs after the guide edits.
• No changeset: doc-only. If the .d.ts text is considered consumer-facing, one patch changeset
  for @dexpace/core and one for @dexpace/codec-json.