docs: complete Genesis/Managed onboarding and promotion journeys (NO_BUMP)

[pcvantol]

Owner-requested coordinated design

Companion to Forge #133 and EP #273. Completes Workspace's planned new-project experience for Genesis and Managed, local/remote adoption and history-preserving promotion. Includes exact-plan artifact/settings previews, role-routed consent, stable operation readback/recovery, source-backed readiness, policy versus grant separation and no hidden first Mission.

Adds detailed design, six PLANNED Workspace nodes and documentary DAG; reconciles the older repository-onboarding text with existing EP B8R while preserving all owner boundaries. Navigation is linked from BOOTSTRAP and the scoped roadmap maps to the canonical onboarding/control-plane lane.

No UI/runtime/schema/workflow/credential/permission/version/release/installation change. No new project or Mission. Workspace remains optional for headless bootstrap and not a Mission-3 prerequisite. The client consumes Forge's artifact manifest rather than creating a second template or topology authority.

Qualification

Shared PB-01..PB-40 families are required future implementation proof, not tests claimed executed by this docs increment. At PR creation exact-head CI and documentary review are pending. No local full product suite/installed UI proof claimed. Merge only through existing protected checks and actual applicable review/authorization.

[pcvantol]

Pre-merge review on 22932f559e9c4e1b1098eed22e6a31888a5aebb6: Workspace consumes Forge #133's single manifest and EP #273's owning operation/readback contracts over HTTP. All five Genesis/Managed create/adopt/promote journeys preserve exact-plan approval, identity/history, no implicit Mission, partial-effect recovery and source-bound readiness. PB-W nodes remain PLANNED and do not gate headless Forge/EP qualification.

The initial foundation check caught removal of the literal Status: proposed design marker in the rewritten onboarding router. Restored the marker while retaining the explicit target/implementation distinction; no test or validation rule was weakened. Workspace CI 35225494270 and TDE observe 35225494162 now succeeded for this head.

Local documentary validation matched the exact remote DAG blob and proved the combined 22-node PB graph acyclic. This is author-side documentation review plus actual repository CI, not an executed UI/bootstrap qualification. Owner explicitly requested the protected documentation merge; no runtime or active policy changes.