docs: harden cold-start branch lifecycle

[tensornull]

Summary:

• make the branch lifecycle safe for a fresh clone without a local dev branch
• fail closed on non-fast-forward dev and never push dev
• route unresolved dependency dispositions through ROADMAP.md
• retain durable clean-artifact evidence without transient process narrative
• define the post-merge main CI, boundary audit, refs, and PR timeline evidence record

Validation: full documented credential-free local gate passed, including 200 offline tests, artifact and clean-install checks, repository independence, workflow checks, and actionlint 1.7.12.

No visibility, settings, rules, secrets, environments, live API, tag, release, or PyPI operation is included.

[tensornull]

Final post-merge evidence (corrected)

• PR: docs: harden cold-start branch lifecycle #12 (squash-merged)
• Topic PR head SHA: 6f202858c26b06e033508f35ef9d63f1a5ce1042 (the merge request's expected head, verified before merge)
• Squash-merge SHA and final main SHA: a6545213cba78498eda574f1e723366acdf9c429
• Merge verification: the squash merge used expected head SHA 6f202858c26b06e033508f35ef9d63f1a5ce1042; its parent is pre-merge main 3e7213333707426410bbeb0f7b1907d71aedc2a7; the resulting squash SHA equals origin/main.
• Default-branch CI: run 29988272235 succeeded for exact SHA a6545213cba78498eda574f1e723366acdf9c429. Offline quality, Python 3.10-3.14, minimum OpenAI, artifact clean-install, and copied-checkout jobs passed; the latest-within-major canary skipped by workflow design.
• Boundary observation: the repository is still private; repository Actions variables, secrets, and environments each report zero; remote tags and releases are absent. Ruleset and branch-protection details were not observable because the private-plan API returned HTTP 403, and are not treated as affirmative evidence.
• Lifecycle attestation: this workflow performed no visibility, settings, rules, secrets, or environments mutation and made no live API, tag, release, or PyPI operation.
• Local refs after fetch and fast-forward-only sync: clean worktree on dev; HEAD = main = dev = origin/main = a6545213cba78498eda574f1e723366acdf9c429. dev was not pushed.

This timeline comment is the durable final evidence record for the post-merge state.