Mark the Group program topology dormant in AGENTS.md

[xor-machine]

Summary

Mark the Group program topology dormant in AGENTS.md. Rail maintenance
under AGENT_LAB_MAINTENANCE=1 at the owner's direction.

Motivation / Context

The packet workflow that drove Group integration is retired. AGENTS.md
still read as though it were the normal path: a Group branch starting at
origin/flow and PRing to flow, with the ordinary branch route mentioned
almost in passing. An agent reading it would re-enter the retired model, which
is how a removed process returns.

Changes

The ordinary route to dev is stated as the route for all new work, and the
Group topology is marked dormant. The human freeze ritual holding flow until
CI/CodeQL pass, and the slice/group vocabulary in the Done line, are dropped:
neither is enforced anywhere and neither describes how work now reaches dev.

Two earlier attempts removed more and were wrong to. The guard still routes
group/* -> flow -> dev in expected_pr_base, and the CI fast job still
runs git merge-base --is-ancestor "$FLOW_R0_SHA" "$dev_head". That topology
is enforced, not merely described, so both CI-asserted phrases are preserved
verbatim and only the framing changed.

5938 -> 5864 bytes against the 6000 budget.

Testing

• bash tests/dev/ci-workflow-cases.sh -- pass, failures=0.
• bash tests/agent/policy-verify.sh -- pass=80 fail=0.
• bash tests/guard/pretooluse-cases.sh -- pass, failures=0.
• ./scripts/dev/test full -- pass.
• Pre-change baseline confirmed clean first, so the passes are not inherited.

Evidence

Cycle 1

• Route: maint/sequester-dev-lane -> dev
• Base: 14ea8955daac371d79fd5685ea4e4cefa771cee0
• Head: 2e482af8d9ec3f049073768491c40d4aa44a1d0d
• Scenarios: N/A - documentation rail change; no product scenario applies
• Assertions: agent policy makes Group branches PR-only integration parents, AGENTS.md binds flow creation to the bootstrap closure
• RED predecessor: 14ea8955daac371d79fd5685ea4e4cefa771cee0
• RED: bash tests/dev/ci-workflow-cases.sh against a first draft that removed the group-slice and R0 closure language, reporting 2 failures -- rc=1 classification=assertion-failure
• GREEN: bash tests/dev/ci-workflow-cases.sh at the exact head, failures=0 -- rc=0 classification=success
• Product mutation: drop-group-slice-phrase -- removing receives changes only through matching group-slice PRs fails the PR-only integration-parent assertion -- detected rc=1 classification=assertion-failure
• CI mutation: drop-flow-closure-binding -- removing the exact-closure-commit clause fails the bootstrap-closure assertion -- detected rc=1 classification=assertion-failure
• Runner: local Bash on Ubuntu 24.04 WSL2
• Duration: suites about 40s; complete test full replay green
• Cleanup: both mutants reverted with git checkout; git status --porcelain empty after each
• Artifacts: N/A - documentation change; all evidence is commands and summaries recorded here
• Unverified: exact-head hosted Required gates and CodeQL pending. The guard, tools/bin/gh, scripts/dev/workflow-check and ci.yml still implement the Group topology; only the doc framing changed, so routing behaviour is unaltered and retiring that machinery remains a separate decision.