spec(ifc-fides): address review; reframe action-metadata for SEP-2061 closure

ifc-fides (review by @JoannaaKL):
- confidentiality is public/private only on the wire; drop the reader-list
  (logins aren't uniform across servers, are themselves access-restricted,
  and reader sets can be huge)
- add Reader-set resolution section: two private markers aren't equal, the
  confidentiality join is the intersection and isn't computable from opaque
  wire markers, so hosts resolve to concrete reader sets at decision time
- integrity join is total/wire-computable; confidentiality join is not
- emitter MUST classify per resource, not per repository (public repos serve
  non-world-readable sub-resources), making github-mcp-server a real proof point

action-metadata / docs:
- SEP-2061 closed 2026-06-13 in favour of this extension; this draft is now the
  canonical home. Updated action-metadata.mdx, README, sep-disposition,
  related-work, and intent-comment status accordingly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs/open-questions.md

@@ -33,8 +33,12 @@ Tracked here rather than in the spec drafts, so the drafts stay non-temporal.
 ## ifc-fides
 
 - Inline `_meta.ifc` for low-friction adoption vs. always behind `evidenceRef`.
-- GitHub Enterprise `internal` repo visibility → public/private/reader-set
-  mapping (audience is the whole org, broader than collaborators).
+- GitHub Enterprise `internal` repo visibility → `public`/`private` mapping
+  (audience is the whole org, broader than collaborators; resolved host-side).
+- Reader-set resolution is host-side by design — confidentiality join across two
+  `private` sources needs the intersection, which the opaque wire marker can't
+  express. Is the 3-step host resolution enough, or do some hosts need a
+  standard `evidenceRef.ref` shape to locate the originating system?
 
 ## Parked (SEP-1913 umbrella)