docs: add upgrade-path + external-infra roadmap; promote Tier 1 to Phase 9

[RNT56]

What

Turns the mid-2026 competitive gap analysis into an actionable, codebase-sourced plan, and promotes its Tier-1 workstream into the canonical work queue.

New docs

• docs/UPGRADE-PATH.md — Tier 1–3 gap-closing task specs in the exact docs/TASKS.md format, every claim file:line-sourced; recaps the protocol, the 7 invariants, the additive-seam pattern, and the three I7 trust classes.
• docs/ROADMAP-EXTERNAL-INFRA.md — 8 gated EXT-01..08 items (managed cloud fleet, hosting/deploy, in-editor + custom models, remote vector index, enterprise SSO/SCIM/RBAC, central secrets, remote registry, Firecracker microVM), each behind an explicit thesis gate (§0). These cross the "one self-hosted binary / no ambient authority" lines on purpose and stay quarantined.

Promotion into docs/TASKS.md — Phase 9 (P9-T01..T07)

• P9-T01 multimodal model.Block + provider image translation — the one serialized, contract-level change (· solo; updates docs/ARCHITECTURE.md when implemented).
• P9-T02 sandboxed headless-browser tool · P9-T03 behavioral verifier (the browser check feeds the verdict — verify stays the sole authority on "done", I2) · P9-T04 SCM/CI webhook → trigger.Signal · P9-T05 gated PR/push GateAction + forge (no autonomous land, I3) · P9-T06 cron triggers · P9-T07 Tier-1 CLI wiring.
• Added the master-DAG rows + a "later phases" note (Phase 7 shipped; Phase 8 = the concurrency workstream; Phase 9 = this).

Housekeeping

• Removed a stray merge-conflict ======= artifact in the CHANGELOG [Unreleased] section.

Why it's safe

• Documentation only — no behavior change. The default binary is byte-identical; every Phase-9 task is itself additive and nil/flag-gated when later implemented.
• docs/TASKS.md is a contract file (CLAUDE.md §5); this is its dedicated, serialized change — no other open branch's primary Owns is docs/TASKS.md. Rebase before merge to absorb any trivial append from the concurrency (Phase 8) workstream.
• make verify is green.

Note

Tasks use a real phase number (Phase 9; Phase 8 is reserved for the in-progress multi-agent concurrency workstream). Tiers 2–3 in docs/UPGRADE-PATH.md remain proposals until similarly promoted — each promotion is its own serialized docs/TASKS.md task.

🤖 Generated with Claude Code