Harden long-running agent execution and verification

[zaozhiyi]

Summary

• lock Goal Contracts and require requirement-linked trusted verification
• add evidence freshness, semantic-audit gating, durable recovery, and progress/budget governance
• harden shell execution, workspace boundaries, credentials, persistence, and public-tree checks
• add CI, security guidance, contribution guidance, threat model, and regression coverage

Verification

• bun run check
• bun test — 68 passed, 0 failed
• bun test --coverage — 88.10% line coverage
• bun audit — no vulnerabilities
• CLI help and auth-list smoke checks

Release note

No project license has been selected. This PR intentionally does not add a LICENSE; the repository remains source-visible until the owner chooses one.