docs: correct the stale 'per-app email secret deferred' note

Per-app (non-shared) email inbound secrets already work and are the
original path: an app-owned email trigger resolves its inbound_secret_ref
against the app's own secret store and seals it AAD-bound to the app
(SecretOwner::App, AAD email:{app_id}); M5.5 generalized that app path to
groups, not the reverse, and the inbound path recovers SecretOwner::App
when materialized_from is NULL. Only the interactive API's inline-vs-named
-ref nuance remains, and it is deliberate. Fixes the CLAUDE.md Track-A
tail and the design-doc M5.5 tail that called it deferred.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/design/groups-and-project-tool.md

@@ -419,7 +419,12 @@ Two distinct constraints:
 > fails apply hard (same as the app path). Pinned by `tests/stateful_templates.rs` + the
 > `stateful_templates` journey. (The per-app `materialized` column in `pic triggers ls --app` shipped as
 > D1.) **Deferred:** cross-owner dedup (a descendant re-declaring an identical trigger double-fires —
-> "overlapping triggers coexist"); the per-app (non-shared) email secret model.
+> "overlapping triggers coexist"). **Per-app (non-shared) email secrets are NOT deferred — they already
+> work** and are, in fact, the original path: an app-owned email trigger resolves its `inbound_secret_ref`
+> against the **app's own** secret store and seals it AAD-bound to the app (`SecretOwner::App`, AAD
+> `email:{app_id}`); the inbound path recovers `SecretOwner::App` when `materialized_from` is NULL. The lone
+> per-app nuance still open is deliberate: the *interactive* `POST .../triggers/email` API takes the secret
+> **inline**, while only the apply path resolves a **named** app secret.
 >
 > **Shipped — group ROUTE templates (live, inherited).** The same live model, adapted to routes. A
 > `[group]` declares a `[[routes]]` template binding a group-owned endpoint; `routes` gained a