Make optional workspace dependencies explicit and fail closed

[Riverbraid]

What changed

• Adds workspace-dependency-contract.json with an explicit OPTIONAL_WORKSPACE_ONLY status.
• Replaces shell-string sibling cd scripts with scripts/run-workspace-command.mjs.
• Preserves rb-check, rb-test, and rb-build as optional workspace commands while making missing sibling repositories emit:

WORKSPACE_DEPENDENCY_UNAVAILABLE

with exit code 2.

• Adds tests/workspace-boundary.mjs, which uses an isolated empty workspace root to verify the unavailable outcome for all three commands.
• Keeps repository-local verify, test, and build separate from optional sibling execution.
• Pins CI to Ubuntu 24.04, Node 20.11.0, and exact checkout/setup-node action commits.
• Runs locked dependency installation with lifecycle scripts denied, the local verifier, the workspace-boundary test, and the local demo build.
• Updates the README with the exact command and claim boundaries.

Exact-head validation

Current head:

9124578dbc7ec1285accc7098df6453fbbab51ec

GitHub Actions run 30289561901, job 90055700184, completed successfully.

Successful steps:

• npm ci --ignore-scripts;
• repository-local verifier;
• deterministic optional-workspace unavailable tests;
• repository-local demo build.

The bounded boundary marker is:

GOLD_V2_WORKSPACE_BOUNDARY_PASS

What this establishes

For the exact draft head:

• the local repository verifier and build execute under the observed environment;
• all three optional workspace commands classify missing siblings as WORKSPACE_DEPENDENCY_UNAVAILABLE with exit code 2;
• missing sibling state is not hidden, laundered into PASS, or confused with the repository-local verification result.

Remaining boundary

The contract does not pin or execute real sibling source commits in GitHub Actions. Actual riverbraid-tsh and riverbraid-wasm-bridge workspace execution remains separately evidence-gated.

This PR does not make Gold V2 self-contained for workspace commands, admit it to an F3/F4 core, alter the Evaluation Kit registry, establish integrated behavior, or claim production readiness, certification, external audit, independent reproduction, or absence of defects.

The PR remains draft and unmerged; main-branch incorporation is a separate disposition.