Clarify Codewith root lineage and coordinator progress

[andrei-hasna]

Lineage

• Todos leaf: E-00098
• Native goal plan: 8eadc06b-7276-4854-a6bc-b879866abf6f

Summary

This is a narrow delta over existing policy. It keeps existing coordinator delegation, worktree, PR-first, adversarial-review, no-budget, and provider rules unchanged while:

• capability-gating the provider-neutral canonical execution root to primitives supported by the active runtime, with Todos authoritative when no such primitive exists;
• linking materially multi-step owner work to one durable execution root and one authoritative Todos root with stable recovery identifiers;
• preventing delegated workers from creating competing root plans or duplicate Todos work outside explicit orchestration ownership;
• requiring coordinators to advance safe non-overlapping work instead of idle-watching or repeatedly polling workers; and
• keeping the exact create-or-reuse native goal-plan requirement exclusively in the Codewith overlay, with only simple one-step answers and lookups exempt.

Validation

• PASS: focused canonical/provider-boundary tests, 5 tests / 115 expectations
• PASS: full suite, 68 tests / 1,038 expectations / 0 failures
• PASS: bun run typecheck
• PASS: bun run build
• PASS: bun run vendor-kit:check
• PASS: git diff --check
• PASS: generic, Claude, and Codewith source/export validation, including one Codewith overlay and no Codewith plan requirement in non-Codewith exports

Secret scans

• PASS: non-printing staged-diff credential, private-key, and token pattern scan
• PASS: non-printing committed-diff credential, private-key, and token pattern scan
• PASS: no Co-Authored-By trailer

Activation after merge

Activation uses the exact OpenIdentities source export for source-set 2026-07-23, followed by the OpenConfigs/Instructions render and apply path. This PR does not render, apply, or activate Instructions.

Rollback

Revert the PR merge commit, or revert repair commit 6f02373 followed by c1699c0, then render and apply the prior exact OpenIdentities export through OpenConfigs/Instructions. Do not edit generated identity exports directly.