Add reusable agent-managed workstreams

[xor-machine]

What changed

• add a reusable work/<slug> and slice/<slug>/<slice> delivery workflow
• allow agents to integrate matching slice PRs only through a check-verifying command
• keep the final draft PR into dev human-owned
• allow direct read-only PR and Actions diagnosis while retaining remote-write and authentication denials
• publish one reusable guide for single- and multi-slice work

Integration safety

scripts/dev/workstream merge requires an open, non-draft, cleanly mergeable slice PR into its matching workstream. It refuses requested changes, missing checks, pending/skipped/failed checks, a missing successful Required gates result, and any changed head commit. It preserves the slice commits with a merge commit. Direct PR merge commands and every push or merge into protected branches remain blocked.

TDD evidence

Cycle	RED	GREEN	Mutation
Workstream AX	7e66ad5: read-only Actions commands blocked; workstream command absent	06097a4: routing, guard, shim, merge-state, documentation, and generated-adapter contracts pass	private-copy removal of the all-checks requirement permits a failed check and is detected RED

Validation

• bash tests/dev/workstream-cases.sh — pass
• bash tests/guard/pretooluse-cases.sh — pass
• bash tests/agent/policy-verify.sh — pass, 46 assertions
• bash tests/dev/security-gate-cases.sh — pass
• ./scripts/dev/lint-scripts — pass
• ./tools/validate.sh — pass
• ./tools/containment-lint.sh — pass
• isolated committed-tree ./scripts/dev/check default quick — pass, 30 suites

The current session retains its startup-time command policy, so the newly allowed direct Actions-log command becomes active after this maintenance change is merged and a fresh session starts.