[containarium-ci]

Proposed by the coding agent on a member's box for #22 (run a6845360).

Review this like any other change. The agent ran on the member's own machine from the text of the issue; the platform has not built or tested it.

• Tests, as reported by the agent: not_run
• Files: 1

The platform made the commit and the branch for this pull request from the files the agent handed back at the end of its run; it does not use the agent's own git state on the box. Anything the summary below says about committing, branching or pushing describes only what the agent itself could do on the box.

The agent's summary, quoted:

Edited only docs/architecture/touchstone.md so it matches what S0 shipped. I checked each item against the files on main, and all six were confirmed, so none were left out. (1) The OpenAPI output path is now openapi/touchstone_v1.swagger.json (merge_file_name=touchstone_v1 plus the .swagger.json the plugin appends). (2) The doc says make generate renames the ScanReport bundle to schema/scan-report.v1.json and that the per-message schema/touchstone.v1.<Message>.jsonschema.bundle.json bundles are committed generated outputs. (3) The doc says include_imports also generates web/src/gen/google/api/*_pb.ts, which scan_pb.ts imports for the HTTP annotation. (4) New 'Reproducible generation' paragraph: pinned remote buf plugins, clean: true, buf.lock pinning googleapis, and make generate wrapping all of it. The generated-output list now includes openapi/ and schema/. (5) After the design's CI gate list I added what ci.yml runs today: job go (vet, staticcheck, tests), job proto (buf lint, buf breaking against origin/main when main has a buf.lock, which it now does, and the generated-code check) and job web (npm install --no-package-lock, tsc --noEmit, vitest run). It also says next build arrives with S9 and the image build and compose e2e with S10. (6) Recorded the missing web/package-lock.json as a known follow-up: commit a lockfile and switch CI to npm ci. I removed the old sentence saying buf lint and buf breaking --against main gate every PR, because the new CI section covers it. Decisions, the delivery-slice table, the test-strategy table and workflow files are unchanged. Tests were not run: this is a docs-only change and no toolchain was installed. Tools used: git (already on the box). Nothing was installed.