docs(02): sync CON-manifest-permissions constraint with DEC-011 Amendment 1

Plan-checker iteration 2 surfaced an informational stale-reference: the
Constraints section's CON-manifest-permissions bullet still listed the
original SPEC §7 5-permission set (`tabCapture`, `activeTab`, `downloads`,
`scripting`, `storage`). This was superseded by:

- Phase 01 DEC-003 Amendment (retired `tabCapture`; added `desktopCapture`
  + `offscreen` + `notifications`)
- Phase 02 DEC-011 Amendment 1 (added `tabs` for D-P2-02 meta.urls feature
  at commit 9dcfcf0)

Updated CON-manifest-permissions to reflect the current 8-entry locked set
with strikethrough on the original 5 + cross-ref to DEC-011 Amendment 1.

Plan-checker iteration 2 verdict: GREEN; Phase 2 plans cleared for
/gsd-execute-phase 2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.planning/PROJECT.md

@@ -105,9 +105,15 @@ nothing is validated until SPEC §10 acceptance passes.)
 - **Tab capture binding**: REMOVED (CON-tab-capture-binding RETIRED). The new
   `getDisplayMedia` binding (CON-display-capture-binding) is screen/window-
   scoped, not tab-scoped, and survives tab switches without re-attach.
-- **Manifest permissions**: `tabCapture`, `activeTab`, `downloads`, `scripting`,
-  `storage`; `host_permissions: ["<all_urls>"]` — exactly this set, no more, no
-  less (CON-manifest-permissions).
+- **Manifest permissions**: ~~`tabCapture`, `activeTab`, `downloads`,
+  `scripting`, `storage`~~ **SUPERSEDED by DEC-011 Amendment 1 (2026-05-20).**
+  Current locked set: `desktopCapture`, `activeTab`, `tabs`, `downloads`,
+  `scripting`, `storage`, `offscreen`, `notifications`;
+  `host_permissions: ["<all_urls>"]` — exactly this set, no more, no less
+  (CON-manifest-permissions, post-Phase-01 retirement of `tabCapture` per
+  DEC-003 Amendment + addition of `desktopCapture` + `offscreen` +
+  `notifications`; Phase 2 Amendment 1 adds `tabs` per D-P2-02). See Key
+  Decisions table DEC-011 row for full provenance.
 - **Storage strategy**: All Phase 1 rolling buffers live in memory only
   (CON-buffer-storage). `chrome.storage` is permitted but MUST NOT be used to
   persist rolling buffers.