docs: implementation-epics plan (EPICS.md)

[gnanirahulnutakki]

Adds docs/EPICS.md — a Notion-ready implementation-epics plan for Sith. Plan/design only; no product code.

What's in it

• Overview — the one-sentence job, non-goals, built-on-OCM, the three federations, status.
• How to read this — the epic/feature/flowchart convention, the closed action-verb vocabulary, and the guardrails, so every epic inherits the anti-drift contract.
• 11 epics (E0–E10), 63 features. Each feature has: what it is, a concrete how-it-works walkthrough, a Mermaid flowchart, acceptance criteria, and the key risk/guardrail. Each epic ends with epic-level exit criteria.
• Roadmap map — a Mermaid diagram of the epics across M0/P1/P2/P3 with dependencies.
• Open questions for the owner — 11 decisions (Ardur wiring timing, token issuer, KMS target, Git host/credential model, signer-key distribution, inter-wave health, staleness threshold, spoke allowlist ownership, MCP exposure, P1 UI scope, tamper-evidence strength).

Epics

• E0 OCM substrate & falsification (M0)
• E1 Tenancy & identity (P1)
• E2 Read federation (P1)
• E3 Credential & key custody (P2; principles day-one)
• E4 Action federation (P2 → P3)
• E5 Policy federation & governance (P1 seam → P2 → P3)
• E6 Audit & decision ledger (P1 seam → P2)
• E7 Governed MCP server (P3)
• E8 Operator console / UI (P1 thin → P3)
• E9 Deployment & packaging (M0 → P3)
• E10 Observability & SRE for Sith itself (day-one → P3)

Consistency & verification

• Written downstream of, and consistent with, the charter, architecture, SCOPE, ROADMAP, threat model, ADRs 0001–0006, and the GitHub milestone/phase issues (M0: Provision OCM hub + 2 kind/k3d spokes (lab) #2–P1: Tenant-isolation test suite (cross-workspace denied at DB layer) #12). No divergent architecture introduced.
• External claims re-verified against upstream sources: OCM cluster-proxy / managed-serviceaccount v0.10.0 (reverse tunnels + scoped-token projection), MCP tool annotations (2025-03-26, hints — enforce server-side), MCP Elicitation (2025-06-18, and its "never request secrets" constraint).
• All 64 Mermaid blocks (63 feature flowcharts + 1 roadmap map) validated by rendering with mmdc; GitHub-flavored Markdown, every diagram in a mermaid fence, for clean Notion publishing.

Note: main is currently the seed commit; the other planning docs this references live on docs/initial-plan. This PR adds only the new docs/EPICS.md, so it merges cleanly regardless of merge order.

[gnanirahulnutakki]

Superseded by the tested dev-to-main Slice 0 release PR #51. The consolidated planning/research content and runnable foundation are now on main at 08c1f9b.