docs: developer & enterprise adoption roadmap

[m1ngshum]

Adds docs/ROADMAP-ADOPTION.md — the companion to docs/ROADMAP.md, covering the adoption track (developer reach + enterprise readiness) rather than the security/DevX feature track.

How it was produced

A grounded research-and-planning pass:

• Two repo audits — current-capability/extensibility map + an enterprise-readiness checklist (every suspected gap verified against code with file:line evidence).
• Four web-research lenses — competitive landscape, enterprise requirements, developer-adoption levers, open-core seams.
• 20 candidates → per-candidate adversarial critique (with repo access; every effort estimate re-derived against the actual code) → completeness critic.

What's in it

• Positioning: the local-first, deterministic neutral endpoint auditor/enforcer — policy in via MDM/git (no backend), enforcement on-device, evidence out via the org's existing log pipeline. "Gate the plane, not the agent."
• 4-wave plan: Wave 0 credibility floor → Wave 1 developer reach (Claude Code adapter is the security: harden MCP server tool path and health check environment #1 lever) → Wave 2 enterprise unblockers (private registry/proxy, SIEM log, SBOM, posture report, cross-client policy auditor) → Wave 3 flagship bets (managed org policy, Linux confine, Sigstore provenance).
• Non-feature risks ranked: awareness (~2 stars, absent from roundups), bus factor = 1, the mcpm.sh name collision, and platform-vendor absorption.
• A suggested release mapping (v0.17 → v1.0) and cross-cutting decisions (one finding/event model; one verify verb; E10a's policy YAML ⊂ E1's schema).

Docs-only. No code changes beyond a one-line companion pointer at the top of docs/ROADMAP.md.