Add bounded agent workflow planning and evidence guidance

[iperev]

Summary

• add an explicit-input change-workflow-plan capability with deterministic state transitions, bounded context closure, dependency-aware actions, machine JSON and concise human output
• add native evidence guidance and agent-envelope prompts for repository-specific witness construction without making ProofKit the native-witness or merge authority
• version the installed and generated CLI carrier contracts for the new public ABI, including compact JSON observations and release change records
• harden process cleanup, diagnostic boundaries, Unicode/stable-JSON parity, package verification, release artifact identity, and bounded registry closeout
• bind every new blocking invariant to exact falsifiers and self-hosting coverage

Validation

• npx --yes --package npm@11.18.0 npm run check
• self-hosting coverage: 83/83 requirements, 238 scenarios, 80 commands
• browser runtime: 93 tests across Chromium, Firefox, and WebKit
• native Docker linux/arm64 installed-package pilot: 43 producer cases and 6 frozen-consumer cases
• independent Docker observation verifier accepted the final epoch and rejected 6/6 mutants
• consumer checkout remained clean and unchanged
• independent final causal review found no admissible defects in the repair delta

Boundaries

This change does not make generated workflow packets, prompts, or local advisory receipts into repository policy, native witness authority, merge authority, release authority, rollout approval, or production-readiness evidence. Registry publication and provider attestations remain release-time claims.