docs(muninn-gate): sync example to reality — mimir-inbox key control scope + staging live (#377)

The mimir-inbox deploy changed two things the committed example documents:
the mimir-inbox key gained the control scope (2026-08-01, for cancel/retry),
and the staging root is no longer a placeholder — it's the real shared dir on
corviduo-dev, path-agreement probe PASS (muninn-dev). Bind was already correct
at :8090 (the stale :8080 was only in the gate repo's own example).

stacks/muninn-gate/conf/muninn-gate.example.yaml

@@ -11,8 +11,10 @@
 ingestion_root: /data/state/ingestion
 
 # Submit-path allowlist (non-empty; each absolute, existing, a directory).
-# Canonicalized at boot. Ratified 2026-07-30. Currently a LOCAL placeholder dir
-# on corviduo-dev; becomes the shared mount when mimir-inbox (the writer) lands.
+# Canonicalized at boot. Ratified 2026-07-30. Real shared dir as of 2026-08-01
+# (mimir-inbox — the writer — deployed on corviduo-dev:8091): 1000:1000 0755,
+# writer rw / gate+watcher ro. Path-agreement probe PASS (muninn-dev, same
+# inode+bytes across writer/gate/watcher; admission byte-identity preserving).
 staging_roots:
   - /mnt/muninn-staging/mimir-inbox
 
@@ -22,7 +24,7 @@ staging_roots:
 keys:
   - name: mimir-inbox
     key: <64-hex-secret, provisioned by infra-ops>
-    scopes: [read, submit]
+    scopes: [read, submit, control]  # control added 2026-08-01 for mimir-dev cancel/retry
   - name: ops-curl
     key: <different 64-hex-secret>
     scopes: [read, submit, control]