docs: query capability (local-union sparql_query) + the read model

Source-verified against nextgraph-rs:
- nextgraph-current-state.md: NextGraph keeps ONE local oxigraph store per
  session; each synced repo is a named graph. sparql_query with NO anchor
  (UserSite/None) queries the UNION of all synced graphs (set_default_graph_as
  _union); with an anchor it is restricted to one repo. Union is read-only
  (updates need a doc anchor). No reactive SPARQL (one-shot). Root cause of the
  ORM fan-out hang: orm_start_graph opens every graph in scope; a fresh/unsynced
  per-entity doc → RepoNotFound aborts the subscription → the 75s never-fires.
- read-model.md (new): the read model — events via the global index (the one
  enumeration hack); everything else by following a shared graph, opened/synced,
  then listed via a single anchorless union sparql_query (never the ORM per-doc
  fan-out); reactivity via re-query on a doc_subscribe/ORM change signal. Plus
  the minimal broker probe to confirm the union behavior.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -29,6 +29,10 @@ Docs (this library's own engineering doctrine, under [`docs/`](./docs/)):
   behaviour on ONE shared wallet (shim, per-document ReadCaps, emulated
   inbox+curator, write guard, faux login, the two axes, the double-proxy
   constraint).
+- [`docs/read-model.md`](./docs/read-model.md) — the READ MODEL the polyfill
+  implements: events via the global index, everything else by following a shared
+  graph; listing via a one-shot union `sparql_query` (never the ORM fan-out, which
+  hangs); reactivity via re-query on a change signal.
 - [`docs/decisions/`](./docs/decisions/) — historical current-SDK ADRs
   (private-store scope, SPARQL delete, shared-wallet login, discovery mechanism).
 - [`docs/fork-inbox-fallback.md`](./docs/fork-inbox-fallback.md) — the Rust-patch /