[Feature]: Expand governed agent framework adapter coverage

[Baziar]

Problem statement

AI-agent projects use several incompatible frameworks, runtimes, package
ecosystems, and verification models. Without one governed adapter protocol,
framework support can drift into framework-specific scaffolding, unverified
dependency upgrades, unsafe file mutation, and adapters that appear selectable
before their claimed platforms are actually proven.

Workspai supports governed Microsoft Agent Framework adapters, but equivalent
coverage is not yet available for other high-value agent ecosystems.

Proposed solution

Current foundation

• workspai.agent-framework-adapter-protocol.v1;
• versioned adapter manifest, capability, conformance report, change plan,
  ownership receipt, and admission candidate contracts;
• governed Microsoft Agent Framework adapters with separate Python and .NET
  identities;
• deterministic scaffold and attach plans;
• bounded, evidence-backed project context;
• managed-file ownership, user-file preservation, runtime resolution, and
  verification binding;
• cross-platform conformance and separate registry admission;
• version discovery that proposes reviewable changes without automatically
  promoting an admitted baseline.

Remaining work

Add independently governed adapters for:

• OpenAI Agents SDK;
• LangGraph;
• PydanticAI;
• Google ADK;
• CrewAI.

One framework name does not necessarily map to one adapter. Separate runtimes,
package ecosystems, or integration boundaries require separate adapter
identities and admission evidence.

Every adapter must implement:

• detect;
• plan-scaffold;
• plan-attach;
• render-managed-files;
• project-context;
• validate;
• resolve-runtime.

Create kits and Attach flows must consume adapters through the existing
protocol. Framework identity remains separate from model-provider identity.

An adapter may not create, replace, or mutate Workspai Model, Graph, Goal,
PCC, verification authority, or Workspace Intelligence truth.

Acceptance criteria

• Each adapter implements workspai.agent-framework-adapter-protocol.v1
  without introducing a parallel adapter contract.
• Every adapter has a versioned manifest, capabilities declaration,
  conformance report, change plan, ownership receipt, and admission candidate.
• Authored-project detection has positive and negative coverage.
• Scaffold and attach plans are deterministic, path-contained, and safe
  against user-authored file replacement.
• Generated managed files have digest-bound ownership receipts.
• Generated artifacts do not persist credentials, secrets, or absolute
  machine-local paths.
• Project context is bounded and evidence-backed.
• Every runtime resolves explicitly and exposes bounded verification
  commands.
• Dependency baselines are explicit and manually admitted.
• Discovery can propose a reviewable baseline update but cannot promote a
  production baseline automatically.
• Every claimed framework version, runtime, and Linux/macOS/Windows lane
  produces manifest-bound, digest-bound conformance evidence.
• A passing matrix creates only an admission candidate.
• A separate reviewed release action is required before registry
  availability.
• An adapter remains fail-closed and unavailable for Create and Attach
  until every claimed lane is admitted.
• Adapter failures remain isolated from unrelated adapters and existing
  Workspai authority surfaces.
• Documentation, examples, and release notes reflect only admitted support.

Completion evidence

Publish one reviewed adapter slice at a time, including its contracts,
deterministic fixtures, offline tests, cross-platform conformance artifacts,
admission candidate, and explicit registry-release evidence.

Alternatives considered

• adding framework-specific Create commands outside the adapter protocol;
• treating a framework name as one adapter regardless of runtime;
• making adapters selectable after unit tests alone;
• auto-promoting discovered upstream versions;
• coupling framework expansion to Graph replacement work;
• allowing adapters to define their own Graph, Model, Goal, PCC, or
  verification behavior;
• adding AutoGen as part of this outcome.

Expected impact

Teams can create or attach supported agent projects with the same ownership,
context, verification, and admission guarantees across frameworks. Contributors
can also take one bounded adapter or conformance slice without taking ownership
of Graph migration or unrelated Workspace Intelligence architecture.