docs(model-apps): record that form-embedded pages are not dependency-tracked

The teardown comment claimed attempting the delete "covers every surface
the platform tracks". True, but it invited the wrong conclusion, because
that set excludes forms.

Measured: a form was built with a page in the MscrmControls.UxAgentControl
PCF's RefId across all three form factors, saved AND published, then read
back to confirm the control persisted rather than being silently stripped.
The page still reported ZERO dependents and DELETE returned 204. The
form's own RetrieveRequiredComponents names the PCF (component type 66)
and never the page, because RefId is an opaque static SingleLine.Text
value the platform cannot know is a reference.

So platform arbitration is authoritative for sitemaps and blind to forms.
The gap is not closable by asking the platform, and a cross-app sitemap
scan would not have closed it either - the reference is not in a sitemap.

No behaviour change. This step only deletes pages this build authored,
while tearing down the app that owns them, so it never deletes on another
owner's behalf. Recording the gap so nobody reads the previous wording as
a stronger guarantee than it is.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 731c1111-d9b6-4fd7-b9d3-347f762ca7f5

Author: akshay-viz

plugins/model-apps/scripts/lib/sdk-teardown.js

@@ -178,10 +178,19 @@ const KIND_HANDLERS = {
   // removed AND published, or when the app+sitemap are deleted outright (which is what the step
   // before this one just did).
   //
-  // So the delete IS the check. Attempting it and reading the platform's answer is strictly better
-  // than a pre-flight scan: it is authoritative (the platform's own dependency graph, not our model
-  // of it), it covers every surface the platform tracks rather than just sitemap XML, and it has no
-  // TOCTOU window — a pre-check can go stale between the check and the delete, this cannot.
+  // So the delete IS the check. Attempting it and reading the platform's answer beats a pre-flight
+  // scan: it is authoritative (the platform's own dependency graph, not our model of it), and it has
+  // no TOCTOU window — a pre-check can go stale between the check and the delete, this cannot.
+  //
+  // KNOWN GAP, measured rather than assumed: that graph covers SITEMAP references only. A page
+  // embedded in a FORM through the `MscrmControls.UxAgentControl` PCF is NOT tracked — a form was
+  // built with a page in its `RefId`, saved and published, and the page still reported ZERO
+  // dependents and deleted with a 204. The form's own required-components list names the PCF
+  // (component type 66) and never the page, because `RefId` is an opaque
+  // `static="true" type="SingleLine.Text"` value the platform cannot know is a reference.
+  // We accept that gap here because this step only ever deletes pages THIS build authored and is
+  // tearing down the app that owns them; it is not closable by asking the platform, and a formxml
+  // scan is the only thing that would close it.
   genpage: {
     // A page another app still references is a SKIP, not a failure — see isDependencyBlocked.
     tolerateDependencyBlock: true,