build: make repository policy and verification machine-enforceable

[dporkka]

Summary

Implements the first high-leverage development-system cleanup from the current setup review: one canonical engineering contract, one machine-readable repository contract, and one verification ladder.

Changes

• Replaces the GitNexus-only root AGENTS.md with the repository-wide engineering contract.
• Makes CLAUDE.md a thin pointer to AGENTS.md instead of duplicating durable policy.
• Adds devplane.yaml so Dev Plane can consume its own repository protocol:
  • worktree isolation
  • clean handoff
  • independent review
  • exact-HEAD evidence
  • named verification profiles
  • path-based high-risk gates
• Requires real PostgreSQL migration verification for migration changes.
• Protects devplane.yaml, scripts/verify.sh, CI workflows, protocol/verifier/policy/security surfaces, and migrations from self-weakening changes.
• Adds scripts/verify.sh as the canonical local/agent verification ladder while delegating to existing Make/npm commands.
• Adds a regression test that parses the actual root devplane.yaml and asserts the safety defaults/risk gates.

Verification model

Profiles:

• static: lint/vet + web typecheck + SDK typecheck
• test: Go/SDK + web tests
• build: production build
• standard: static + test + build
• race: standard + race tests
• integration: race + integration fixtures
• live: integration + live E2E

The existing CI make test path includes packages/repoprotocol, so the new repository-contract regression test is automatically exercised once an authoritative runner can execute the workflow.

Current gate status

GitHub Actions run 602 fails all three jobs before any steps execute (runner_id=0, empty step lists). PR #133 / run 601 shows the same pre-step failure pattern.

A disposable control PR (#135) added a one-step ubuntu-latest workflow containing only echo/uname. That probe also failed before any step executed, proving the current failure is above the Dev Plane build/test toolchain. The probe PR was closed after diagnosis.

Nulang organization-scoped Actions jobs are currently dispatching and executing normally, which further isolates the problem to the personal dporkka Actions scope rather than GitHub Actions globally.

Keep this PR draft until an authoritative runner executes the required checks; do not weaken or bypass the gate.

Notes

No runtime orchestration behavior is changed. This PR establishes the policy/configuration substrate that later Dev Plane scheduling, verification, and landing work can consume without duplicating repo-specific semantics.