manage_adr sections argument silently permits whole-document replacement

[M-Marbouh]

Problem

The manage_adr tool schema advertises a sections array beside mode=update, but the handler never reads that argument. An update request that supplies sections still calls the whole-document store primitive and replaces the complete ADR.

A caller can therefore believe it is updating selected sections while silently deleting every omitted decision.

Reproduction

1. Store an ADR containing two or more sections.
2. Call manage_adr with mode=update, a sections array naming one section, and content containing only that section.
3. Call manage_adr with mode=get.
4. Observe that the returned ADR contains only the replacement content; all omitted sections are gone.

Expected behavior

Until an append or section-scoped CAS API exists, the tool must fail closed:

• do not advertise sections as a write argument
• explicitly reject legacy requests that still provide sections before opening or writing the store
• document and label mode=update as whole-document replacement

Scope

This issue is limited to closing the misleading write-contract footgun. It does not add append, CAS, or Markdown-authoritative storage.

Related durability and architecture work: #516 and #507.