Record the spent-project reversal as ADR 0007

The project file existed to persist state, so a future reader finding
the exported flag would otherwise re-litigate it. The ADR states plainly
that this reverses an earlier decision, what the original reasoning was,
and what changed in use.

ADR 0002 deferred the SVG renderer partly because re-export made it free
to add later. That no longer holds, so its 'not stranded' bullet is
struck through and pointed at ADR 0007 rather than left standing to
mislead whoever revisits the SVG question.

docs/adr/0007-a-project-is-spent-once-exported.md

@@ -0,0 +1,45 @@
+# A project is spent once its song has been exported
+
+Exporting a song marks its project file spent. Opening the PDF again starts a
+**fresh session from detection** — no cuts, no discards, no metadata carried
+over — rather than resuming. `--resume` on `edit`, `export` and `project`
+overrides it when the old state really is wanted.
+
+This **reverses an earlier decision**, which is the reason it needs recording:
+the project file was introduced specifically so that state would persist, and
+`docs/spec.md` and `CONTEXT.md` promised resume-across-sessions and re-export
+until this ADR was written.
+
+## What was decided before, and why it changed
+
+The project file was chosen over "bundle only" for three benefits: crash safety,
+resume across sessions, and re-export. The third was the strongest argument —
+change the width cap, fix one cut, or add the SVG renderer later, and every
+song's bundle regenerates without repeating any human work. ADR 0002 leans on it
+explicitly when deferring the SVG renderer: "re-export from the project file
+regenerates every song's bundle without repeating human work, so songs cut
+before the SVG renderer exists are not stranded."
+
+In use, persistence was the wrong default. Re-opening an exported song silently
+resurrected old decisions, so a deliberate re-cut began from stale state instead
+of a clean page — and because autosave writes that state straight back, closing
+the window did not clear it either. An export is a natural end of a unit of
+work; carrying its decisions past that point makes "start over" impossible to
+express.
+
+Crash safety and resume within a session are untouched, and those are what the
+day-to-day authoring loop actually depends on: a session interrupted halfway
+through a 12-page scan still picks up where it stopped.
+
+## Consequences
+
+- **Re-export is no longer free.** Changing the 1920px cap, changing the encoder,
+  or adding the SVG renderer means re-cutting each song by hand. ADR 0002's
+  "not stranded" reasoning no longer holds; if the SVG renderer ships, already
+  exported songs stay WebP unless they are cut again.
+- The flag is written in `bundle.write`, not in its callers, so no export path
+  can forget it.
+- The project file is kept rather than deleted, so `--resume` remains possible
+  and the state is still there to inspect after the fact.
+- A CLI export from a PDF with no project file now writes one, marked spent.
+  That is the record that this PDF has already been exported.