plan: M2 splits in two (amendment A6)

The design review found the milestone's gate names a corpus that is not there:
`mongodb/specifications` has no aggregation suite, and the thirteen
`aggregate-*.json` files this project runs live inside `crud` and test the
aggregate *command*, not stages. One name was covering two milestones.

M2 becomes the command surface -- $out, $merge, db.aggregate(), collation,
let -- gated on the corpus that already exists, at 0 fail. M2.5 becomes the
engine: expression evaluator, per-stage document iterator, accumulators,
$unwind; $lookup and $facet explicitly out of the first cut, gated on a
corpus this project writes with every expectation measured against mongod.

Command surface first, engine second, chosen with the cost stated: the engine
is what gives wrong answers now -- six of eight probed pipelines answer ok:1
with a wrong result -- so this order leaves them alive a milestone longer.
Which is why M2 carries the refusals: every unimplemented construct stops
answering 0 and starts answering an error with a measured code, the same move
expectEvents made before the free list in M1. It will push the scorecard down,
and that is the point.

The review keeps its pre-decision recommendation verbatim, so the argument the
decision overrode stays legible.

docs/M2_DESIGN_REVIEW.md

@@ -219,7 +219,23 @@ out of scope.
 
 ---
 
-## 5. Recommendation
+## 5. Decision
+
+**Taken: the command surface first (Option A as M2), the engine second (M2.5),
+with Tier 0 folded into M2.** Recorded as PLAN amendment A6; the §3 rows are
+rewritten and §6's deferred entry now points here.
+
+The cost of that order is on the record: the engine is what gives wrong answers
+today, and this leaves them alive for a further milestone. Tier 0 is what makes
+the trade acceptable rather than merely convenient — every unimplemented
+construct stops answering `0` and starts answering an error, so the wrong
+answers become visible bug reports instead of quiet ones while the command
+surface is built. It is not optional under this sequencing.
+
+The recommendation the review arrived at independently is kept below, since a
+decision is easier to revisit when the argument it overrode is still legible.
+
+## 5.1 Recommendation as written before the decision
 
 **Tier 0 first, alone, before any scoping decision is final** — the same
 argument that put `expectEvents` before the free list in M1. Six silent wrong