docs(bots): reconcile design-doc SHA prose with the actual pin (3963f4b)

Addresses the engineer-bot's "needs human decision" review thread: the code pin
is correct (3963f4b = latest engine main, single-sourced in bot-prelude), but the
design doc's chronological prose still surfaced superseded SHAs (d780b2d,
d24ca21, b6205fb, d9cb1e6) as if current. Add an AUTHORITATIVE banner at the top
stating the current pin + wiring (banner wins over the draft history below), and
mark the stale "Pinned to d9cb1e6" line as as-written history. No code change —
.github/ already pins only 3963f4b.

Signed-off-by: Eric Wang <e.wang@databricks.com>
Co-authored-by: Isaac
Signed-off-by: eric-wang-1990 <e.wang@databricks.com>

Author: eric-wang-1990

docs/superpowers/specs/2026-07-14-onboard-bot-engine-design.md

@@ -4,6 +4,19 @@
 **Status:** Approved (pending spec review)
 **Repo:** `databricks/databricks-sql-python`
 
+> **AUTHORITATIVE — current state (read this, not the chronology below).**
+> - **Engine pin:** `3963f4be76be3b4ac0382ca0d7b6bf9d051929e6` (latest
+>   `databricks-bot-engine` main), defined in **ONE** place —
+>   `.github/actions/bot-prelude` `engine-ref` default. `.github/` has no other
+>   SHA.
+> - **Wiring:** each bot is its **own job** calling the local `bot-prelude` →
+>   `install-bot-engine` composites (the engine is pip-installed, PAT-free via an
+>   engine-scoped App token). We do **not** `uses:` the engine's reusable
+>   workflows — that doesn't resolve cross-repo.
+> - The `## Engine pin` / `## Design` sections and the `d780b2d…`, `d24ca21`,
+>   `b6205fb`, `d9cb1e6` SHAs below are the **superseded draft history**, kept
+>   for context. Where they conflict with this banner, the banner wins.
+
 ## Problem
 
 The repo currently runs the PR **reviewer bot** from *vendored* code under
@@ -195,10 +208,12 @@ databricks-bot-engine, adopting **both** bots and used to surface onboarding
 friction back to the engine.
 
 ### Reviewer — flipped to PAT-free App-auth
-Pinned to engine SHA `d9cb1e63dc31eed550194a29d1cfd7de9c9c793b` (post-#107, which
-selects the engineer author flow from the issue **Type** — Bug ⇒ bug-fix,
-Task/Feature ⇒ task (the engine renamed the old `enhancement` flow to `task`);
-earlier drafts pinned `d24ca217`, then `b6205fb`, post-#100). Both reviewer
+Pinned to engine SHA `d9cb1e63dc31eed550194a29d1cfd7de9c9c793b` at the time of
+this update (the pin has since advanced to `3963f4b` — see the banner at the top;
+this paragraph is left as-written history). The pin selects the engineer author
+flow from the issue **Type** — Bug ⇒ bug-fix, Task/Feature ⇒ task (the engine
+renamed the old `enhancement` flow to `task`); earlier drafts pinned `d24ca217`,
+then `b6205fb`, post-#100. Both reviewer
 workflows pass `engine-auth: app` and **drop `engine-pat`**: the reusable mints a
 short-lived, engine-scoped GitHub App installation token from the review-bot App
 creds it already receives. No `BOT_ENGINE_PAT` secret. The same SHA is pinned in