Define structural WorkItem domain and readiness assessment

[acgxv]

Summary

• add the canonical structural WorkItem model and eight-state lifecycle vocabulary
• add closed one-Project dependency graph validation and deterministic non-authoritative readiness assessment
• enforce bounded, credential-negative fields and combined Program/Objective observation limits

Architecture boundary

This slice intentionally grants no readiness, execution, review, completion, PostgreSQL, runtime, or effect authority. Those remain transactional downstream concerns.

Validation

• cargo test -p decodex-core work_item --all-features (23 passed)
• cargo test -p decodex-core --all-targets --all-features (107 passed)
• cargo clippy -p decodex-core --all-targets --all-features -- -D warnings
• pinned nightly cargo fmt --all -- --check
• cargo make test-vnext-architecture (19 passed)
• canonical cargo make check (394 passed, 23 configured skips)
• independent exact-candidate review: APPROVED/READY

Linear: XY-1342