docs: document volume request lifecycle contracts

[AleksZimin]

Description

Document the effective VolumeCaptureRequest and VolumeRestoreRequest contracts:

• provide schema-valid VCR and VRR examples;
• describe actual execution-required fields and source-specific restore behavior;
• separate emitted, compatibility-only, and unused condition reasons;
• document effective RBAC actors and current identity-enforcement limits;
• correct request GC, ObjectKeeper, DataImport adoption, and TTL semantics;
• distinguish current behavior from planned SDK consumer changes.

This PR changes documentation only. It does not alter CRDs, controllers, provisioner behavior, or deployment resources. It has no impact on the control plane, Prometheus, ingress controllers, or other critical cluster components.

Why do we need it, and what problem does it solve?

State-snapshotter and domain controllers depend on VCR/VRR behavior, but the previous documentation included invalid examples and overstated identity, template, RBAC, and retention guarantees.

A consumer following those examples could create a VRR that the executor silently ignores, misunderstand which fields are authoritative, or make incorrect assumptions about artifact lifetime and access control.

What is the expected result?

Consumers can determine:

• which request fields are required by schema and runtime;
• how VSC-backed and PV-backed restore paths differ;
• which component writes request status;
• which reasons are terminal or pending;
• what identity checks are and are not enforced;
• when requests, artifacts, keepers, and restored PVCs are deleted.

No runtime behavior changes.

Validation performed:

• storage-foundation API tests passed;
• affected controller tests passed;
• Markdown lint, example validation, and git diff --check passed.

E2E and manual cluster tests were not run.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.