[codex] Document development plan and contributor workflow

[mimeding]

Business rationale

Osaurus is at its strongest when contributors can ship harness improvements without guessing which local gates, CI rules, or roadmap priorities matter. This PR makes the development plan and clean-PR workflow explicit so document fidelity, agents, plugins, privacy, and release work move through the same predictable review path.

Coding rationale

The plan lives in docs/ and links outward from contributor-facing entry points instead of being scattered across comments or PR descriptions. The CI-cleanliness rule is documented in Cursor rules, the PR template, and a small shell gate so future branches can fail before GitHub does. The workflow cache notes stay in CI/developer docs because they explain operational behavior without changing product code. The branch was rebased onto current origin/main, dropping stale stacked code that now belongs to already-green bug-fix PRs.

What changed

• Added docs/DEVELOPMENT_PLAN.md with phased priorities, near-term sprints, security/privacy backlog, file-I/O sequencing, and definitions of done.
• Refreshed docs/CONTRIBUTING.md, docs/DEVELOPER_TOOLS.md, docs/FEATURES.md, and README.md links around the clean local verification path.
• Added .cursor/rules/pr-clean-ci.mdc and updated .cursor/rules/swift-build.mdc for PR readiness expectations.
• Updated .github/pull_request_template.md and .github/workflows/ci.yml to make required checks and cold DerivedData behavior clearer.
• Added scripts/ci/check-pr-clean.sh for local branch/readiness checks.

Validation

• swift build --package-path Packages/OsaurusCore
• swift build --package-path Packages/OsaurusCore -c release
• swift test --package-path Packages/OsaurusCore
• shellcheck scripts/ci/check-pr-clean.sh
• git diff --check origin/main...HEAD
• git diff --check

Non-scope

• No product behavior changes.
• No changes to Swift package APIs.
• No new third-party dependencies.

Residual risks

• GitHub CI was restarted by the rebase push and should be watched to completion.
• The plan will need periodic updates as maintainer decisions land and roadmap priorities change.

[mimeding]

Author-side cleanup complete; this PR is now ready for review.

Verification:

• GitHub checks are green: test-core, test-cli, swiftlint, shellcheck, update_release_draft, and pr-clean-gate.
• scripts/ci/check-pr-clean.sh osaurus-ai/osaurus 986 reports clean.
• Local verification from the clean worktree passed for swift build, targeted OsaurusCore tests, conflict-marker scan, and shellcheck on the clean-PR gate.

This branch includes the same PR CI hardening and FluidAudio 0.14.3 lock alignment as the now-green recovery branches.