[codex] Add admin document ingestion workflow

[tiramitree]

What changed

• Added an admin-only document ingestion workflow to Project 1 with tenant, role, classification, MIME, source-hash, replace, chunking, and audit controls.
• Added controlled browser UI intake and refreshed Project 1 evidence surfaces for documents, traces, audit events, connector status, and source quality checks.
• Added runtime hardening across all three demo services: request body limits, request governance headers, request IDs, local signed demo auth boundaries, response/trace/audit request correlation, and runtime state isolation.
• Added Project 2 workflow/outbox/idempotency evidence and stronger governed side-effect surfaces.
• Added reviewed eval ledger, nightly regression workflow, retrieval/source-scan/parser-quality checks, governance control registry, updated API contracts, and expanded public evidence docs.
• Added industrial gap plans documenting what still separates the portfolio from true production deployment.

Why

This closes several large portfolio gaps: controlled source ingestion, request-level governance, traceable audit correlation, repeatable eval review, and CI-backed regression evidence. The branch is still a local/demo-grade reference implementation, but it now demonstrates many of the operating boundaries that real enterprise AI systems need.

Validation

Local validation on commit 37e6f99:

• git diff --check
• python -B scripts/dev.py quality
• python -B scripts/dev.py verify
• python -B scripts/dev.py safety
• python -B scripts/dev.py dependency-surface
• python -B scripts/dev.py source-scan
• python -B scripts/dev.py trace-redaction
• python -B scripts/dev.py github-readiness
• python -B scripts/dev.py pr-triage

Remote validation on PR #13:

• quality-gate: passed
• nightly-regression: passed

Notes

main is intentionally protected. This PR remains blocked by the configured review requirement, not by failing checks.

[tiramitree]

Maintenance update: repository launch metadata, topics, merge policy, secret scanning/push protection, main branch protection, and label manifest were re-applied. The latest head d0aaf9c has remote quality-gate and nightly-regression passing. Remaining blocker is the configured review requirement.