docs: complete Genesis/Managed project bootstrap and artifact manifest (NO_BUMP)

[pcvantol]

Owner-requested design delivery

The owner explicitly requested the missing new-project design in Forge, EP and Workspace, their roadmap DAGs, and protected merges here; additionally required complete bootstrap for BOTH Managed and Genesis.

This PR supplies the Forge-owned target design, a 28-entry conditional portable artifact inventory, 40 qualification scenario families, nine PLANNED Forge delivery nodes and a documentary DAG. Covers absent/empty/unborn/existing repositories, adoption, stable identity before first commit, deterministic approved manifests, safe repository birth, local-only Genesis, Managed governance readback and history-preserving explicit promotion.

Boundaries

forge server init remains installation-storage init. No runtime/scaffolder/API implementation, package/version changes, credentials/grants, repository provisioning, active policy changes or Mission 3 changes. Forge owns plan/meaning; EP owns actual effects; Workspace owns UX. No fake Mission or first-commit SHA, no protected-main bypass. The diagram is documentary and not executable programme state.

Roadmap

Refines existing L1/L1-R and F2/FH. New scoped roadmap is linked from BOOTSTRAP and links back to canonical strategic authority. Existing runtime/gap statuses are not falsely closed. Workspace is not a headless bootstrap prerequisite.

Coordinated branches

• EP: codex/project-bootstrap-execution-v1
• Workspace: codex/project-bootstrap-onboarding-v1
  Both companion designs remain pending until their own merges. Existing EP #271/#272 work is untouched.

Validation

Exact-head GitHub CI and documentary integrity review are pending at PR creation. No local full product-suite or installed bootstrap execution is claimed; this environment cannot clone from GitHub over its container network. Merge only after required checks and applicable review requirements are satisfied.

[pcvantol]

Documentary cross-product review on Forge head 127751fce48aad47118d07444e4fb8f3b944742c, EP #273 head 869bf426baf174eaac02bf79ac7c0ec2839e1022, Workspace #34 head 22932f559e9c4e1b1098eed22e6a31888a5aebb6:

• 9 Forge + 7 EP + 6 Workspace PLANNED nodes. Ran a local JSON/topological validation on copies whose Git blob SHA-1 exactly matches all three fetched remote DAG blobs (6a1d5a5…, 169cddb…, 87d77e1…). All internal and combined PB dependencies are acyclic, all PB references resolve, and neither headless Forge nor EP closure depends on Workspace. Three existing FH capabilities are explicitly external parents, not marked implemented by this test.
• All five new/create/adopt/promote journeys are covered, including absent/unborn repositories, exact target/privacy authorization, owned operation recovery and no implicit Mission.
• Clarified the JSON inventory's optional GitHub security/ownership/dependency conditions to require MANAGED_GITHUB explicitly; Genesis local validation/security remains separate.
• Workspace's existing Status: proposed documentary marker was preserved without weakening its validator.
• This is author-side architectural/documentary validation, NOT an independent runtime Quality/Security receipt or an executed PB-01..40 qualification suite. CI remains the source of repository-check outcomes. No production code, CI/protections, versions, installations, credentials or Mission state changed.

Companions: pcvantol/engineering-platform#273 and pcvantol/workspace#34. Awaiting final required checks before the owner-authorized protected merge.