docs(workflow): establish evidence-driven project execution

[TusanHomichi]

Primary Issue

Closes #71. The issue owns the canonical task graph and next action.

Problem And Outcome

Consolebook already requires issue-linked work and full verification, but lacked a shared procedure connecting acceptance, delegated ownership, exact-revision evidence, and authorized continuation. Make that procedure the standing project default while preserving the existing product contracts and gates.

Changes

• Add docs/workflow.md with model roles, one canonical issue graph, explicit authority and repair limits, artifact receipts, review, resume, and cleanup rules.
• Keep AGENTS.md concise; link the procedure from contribution and development guidance.
• Reuse the roadmap for current state and add graph/evidence pointers to the existing issue and PR templates.

Documentation and instructions only; no runtime behavior, schema, public API, product ADR, or CI changes.

Verification

Candidate 592c4dca0c298c3cadba91531e0f2d731b5e682f; tree dc55d7384b3e7dd71dcf0abc03e28c98e5a57d28.

All required local checks passed:

web/: npm ci; npm run check; npm run build
cargo fmt --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace                         # 175 passed
cargo build -p consolebook-server
web/: npx playwright install chromium; npm run e2e  # 10 passed

Local E2E used bundled Google Chrome for Testing 151.0.7922.34. Diff whitespace, changed relative links/heading anchors (with negative controls), template YAML, and command/CI consistency checks passed. A fresh read-only Codex session loaded the updated instructions and correctly distinguished linked documents. Local receipts, commands, artifact hashes, and review.

The separate hosted pr-gate run passed all web/Rust/browser steps (175 Rust and 10 browser tests). Its synthetic merge commit e8db650b75ef17d977498815c2e1f67a906530a9 has the exact candidate tree. This is not merged-main verification. Existing CI does not upload executable/assets artifacts, so local output hashes are not claimed for hosted bytes.

Existing warnings remain: the three low-severity npm audit entries tracked by #54 and browser color-environment warnings. No gate failures or retries occurred.

Review And Merge Notes

Primary self-review and a separate Astra/max documentation review were completed; artifact-hash and global-instruction-selection findings were corrected before freezing. No human review is claimed.

Review focus: permission provenance, the two-cycle default repair bound, one live graph, and accurate evidence claims. This is a documented procedure, with no scheduler or automatic enforcement. The original checkout, untracked handoff/review files, and unrelated worktrees are preserved.

Issue/PR publication is authorized. Merge remains the maintainer's decision; no standing merge, deployment, or paid-service authority was established for this setup. Preserve the task branch/worktree until that decision. After an authorized merge, verify the exact main revision, archive/read back its receipt, and remove only owned task resources.