Harden AI delegation, setup teardown, and knowledge docs

[DenWin]

Goal

Provide durable, product-specific AI delegation and a sourced documentation graph while making one-time setup safe to complete without leaving broken references.

Scope

• Keep shared repository guidance in AGENTS.md; keep Claude and Codex model/delegation mechanics in their own entry points. Make mechanical commit delegation opt-in and document its token trade-offs.
• Define Markdown and AsciiDoc as first-class formats under the reduced OKF-inspired convention; add documentation, overlay, and optional-skill indexes.
• Convert the complete human TDD knowledge base to AsciiDoc and retain the supplied editorial assessment, external-skill survey, and skill evaluation as linked evidence. Runtime SKILL.md files remain Markdown.
• Complete the AI-maintainer GitHub App path with a repository-scoped installation-token helper, fail-closed identity verification, corrected fine-grained PAT limits, and accurate commit-signing guidance.
• Make Complete-Setup.ps1 verify identity and remove explicitly marked setup-only references from permanent docs before deleting setup/.
• Align MIGRATION.md, setup version/changelog, Semgrep guidance, and GitHub automation claims with the current mechanisms and primary sources.
• Preserve the Gitleaks private-key rule while avoiding the false-positive fixture and keeping local/CI Gitleaks versions aligned.

Risk & rollback

Moderate. The setup scripts now enforce stricter identity preconditions and transform marked permanent documentation during teardown; tests cover both failure ordering and exact cleanup. The new App token helper reads a local private key and emits only a short-lived, repository-scoped token to stdout. The TDD documentation extension change could affect external deep links, but all in-repo Markdown and AsciiDoc links were checked. Roll back by reverting this PR; generated repositories should not run Complete-Setup.ps1 until this PR is merged and their setup steps are complete.

Evidence

• pre-commit run --all-files — all hooks passed, including Gitleaks, AsciiDoc, PSScriptAnalyzer, and the Fast test lane.
• .config/scripts/Invoke-TestLane.ps1 -Lane Fast — 88 tests passed, 0 failed.
• Focused AI-maintainer/teardown suite — 46 tests passed, including cryptographic JWT verification and repository-scoped token request behavior.
• Teardown simulation — cleaned all five permanent files and left no setup/ references.
• Markdown and AsciiDoc relative-link checks — no missing local targets.
• git diff --check — passed.
• Commit and pre-push hooks — passed; the pre-push Standard test lane was green.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aadf62c1c3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".