feat: pilot selective standards and align privacy copy

[pitimon]

Summary

• add a repository-owned standards index with selective routing for parser, privacy, API, and release conventions
• bound the initial standards pilot to issues [bug]: Kiro CLI mutable request deltas stay in the start bucket across days #164, [bug]: OpenCode and Kilo mutable message deltas reuse stale timestamps #165, and [bug]: Craft cumulative growth can fall back to stale createdAt #166 without implementing or closing them
• keep standards subordinate to CLAUDE.md, OpenWiki, user/system instructions, human review, and existing approval gates
• synchronize privacy disclosures with runtime behavior across authority docs, CLI copy, dashboard source/built copy, llms.txt, OpenClaw docs, and localized Settings copy
• document both local queues, project identifiers, browser localStorage caches, optional outbound calls, and approved provider credential flows
• remove obsolete unused cloud-auth/cloud-record copy keys
• add fail-closed contract tests for index shape, authority paths, symlinks, routing scope, privacy lifecycle, shipped/built copy, translations, and executable verification defaults
• bump npm, macOS, and Windows versions in lockstep to 0.39.49 for the release-bound copy fix

Non-goals

• does not implement or close [bug]: Kiro CLI mutable request deltas stay in the start bucket across days #164, [bug]: OpenCode and Kilo mutable message deltas reuse stale timestamps #165, or [bug]: Craft cumulative growth can fall back to stale createdAt #166
• does not install Agent OS/Claude-specific commands
• does not replace 8-Habit, TDD, CI, independent review, or release gates
• does not change parser/API data paths, merge, publish, release, deploy, or modify runtime services

Verification

• node --test test/agent-standards.test.js — 14/14 passed
• npm run test / npm run ci:local — 1087/1087 root tests passed
• dashboard — 42/42 test files passed; production build succeeded
• OpenWiki deterministic fact check — 0 findings
• architecture guardrails, outbound inventory, and version lockstep — passed
• scoped secret scan — 0 findings
• git diff --check — passed
• independent Hermes review — PASS, no remaining critical/high findings
• hardened Codex QA (same_family_qa) — all seven product/code gates PASS; hosted-CI handoff remains CONCERNS until GitHub reports green on the final SHA

Pilot decision after evidence collection

After the three-issue evidence set, compare missed applicable standards, irrelevant loaded standards, context size, review findings, and implementation regressions before retaining, revising, or removing this routing layer.

Fixes #173

[pitimon]

Reopening to retrigger the pull_request CI event; the initial open produced no check run.

[pitimon]

Local verification and independent review are complete: npm run test 1084/1084, npm run ci:local passed, dashboard 42/42 test files, OpenWiki 0 findings, final review PASS. GitHub has not created a CI run for this PR despite reopen and synchronize events; statusCheckRollup remains empty. Leaving the PR open and unmerged until the repository check is available or this absence is explicitly accepted.

[pitimon]

Codex QA loop completed on final content (reviewer route: same_family_qa). Confirmed findings were fixed and regression-tested: local persistence topology, optional outbound disclosures, credential lifecycle, OpenClaw metadata, shipped CLI/dashboard/llms copy, localized Sync Now copy, visible + JSON-LD FAQ consistency, and obsolete cloud-auth keys. Final Codex verdict: CONCERNS only because hosted GitHub CI is absent. Local final evidence: standards 14/14, root 1087/1087, dashboard 42/42 test files, OpenWiki 0, version lockstep/outbound/guardrails passed. Current SHA is 1b12dc9; Actions API still reports 0 runs, so merge remains blocked.