Add research-project router skill

[jerome-queck]

Why

Research projects have Definition-based identity and seven project routes, so extending /learn would make one command carry two incompatible contracts. This adds a separate, user-invoked router that discovers the synced project, then yields to its live controls.

Prerequisite #207 has landed. This branch was rebased onto its squash commit and now contains only the research-project skill change.

What changed

• adds the dual-harness /research-project <project identity> [-- what to work on] skill
• adds an executable macOS Drive candidate finder with resolved-alias deduplication
• records the /learn boundary and installation decision in ADR-0025
• updates agent wayfinding, machine setup and MAP
• adds focused invocation, discovery, privacy and route-boundary tests

Verification

• npm run check
• npm test — 674 passed, 0 failed, 1 expected skip
• focused research-project skill tests — 6 passed
• live candidate discovery resolves the configured Research project
• independent acceptance review: no findings

The generic skill-creator quick validator cannot assess the dual-harness package because its hardcoded frontmatter allowlist rejects disable-model-invocation and argument-hint; those fields are required by the repository’s writing-for-agents mechanics and match the existing /learn package. Codex invocation is also encoded as policy.allow_implicit_invocation: false in agents/openai.yaml and enforced by tests.

Closes #209

#209 — Add a research-project router skill: 12 of 12 criteria delivered, nothing beyond the brief.

Assisted-by: GPT-5-Codex
Co-authored-by: Codex noreply@openai.com