ci: dogfood GroundAtlas project control

[shtse8]

Summary

Dogfood the released GroundAtlas package/action in SylphxAI/codec and add a PR/merge-group package-control gate:

• add vendor-neutral project.manifest.json while keeping .doctrine/project.json as the Sylphx-specific adapter;
• add CI for push, pull_request, and merge_group with bun run validate, project-control tests, and SylphxAI/groundatlas@v0.1.2 using groundatlas@0.1.2;
• add README, ADR, spec, SECURITY, and project-control tests so humans/agents have a clear SSOT map;
• keep .groundatlas* as generated evidence/navigation only;
• document the existing Biome lint backlog and all-workspace build backlog as explicit adoption gaps rather than pretending they are green.

GroundAtlas publish proof

groundatlas@0.1.2 is live on npm and the action release exists:

{
  "version": "0.1.2",
  "gitHead": "38ce903733901cd2954a01aa4d31d7968de00ead",
  "dist.integrity": "sha512-WL+N3IJ13m2/mYOWAYzlv6XIcfG4WctnafI1xXnsf5zsuEAx6giTEJ8HjUsfhbTRH6e/PFjIBV1NB2p1smN8ug=="
}

Release: https://github.com/SylphxAI/groundatlas/releases/tag/v0.1.2

Validation

• bun install --frozen-lockfile
• bun run validate
  • release-critical root build passed (@sylphx/codec-core, @sylphx/codec, @sylphx/codec-cli)
  • all-workspace tests passed, including @mconv/*, mconv, and @mconv/wasm cargo tests
• node --test test/project-control.node-test.mjs
• YAML parse for .github/workflows/ci.yml and .github/workflows/release.yml
• npm exec --yes --package groundatlas@0.1.2 -- ga update --out .groundatlas-pilot
• npm exec --yes --package groundatlas@0.1.2 -- ga audit --out .groundatlas-pilot
• npm exec --yes --package groundatlas@0.1.2 -- ga manifest --out .groundatlas-pilot --json
• npm exec --yes --package groundatlas@0.1.2 -- ga fleet . --out .groundatlas-pilot --require-atlas --strict --json

GroundAtlas local readback selected project.manifest.json with adoptionStatus: adopted; strict fleet summary was adopted: 1, warning: 0, blocked: 0, total: 1.

Boundary notes

• project.manifest.json is the vendor-neutral project control file.
• .doctrine/project.json remains the Sylphx Doctrine adapter/governance catalog.
• .groundatlas* reports remain generated evidence/navigation only, not SSOT.
• This PR does not publish a new Codec package version; package publishing remains Release workflow + npm registry readback when changesets declare version changes.
• Existing bun run lint and all-workspace build gaps are recorded for dedicated follow-up slices before they become required contexts.