Dogfood GroundAtlas package gate

[shtse8]

Summary

• add vendor-neutral project.manifest.json for @sylphx/webgpu and keep .doctrine/project.json as the Sylphx Doctrine adapter
• add a single GroundAtlas CI job using SylphxAI/groundatlas@v0.1.2 with groundatlas@0.1.2
• gate the existing native build matrix through needs: groundatlas plus an explicit failure step, without duplicating GroundAtlas across every platform target
• add project-control boundary tests, ADR/spec docs, SECURITY.md, and repo docs updates

Boundary

• No native WebGPU behavior, package exports, platform package artifacts, runtime tests, release artifacts, or compatibility claims changed.
• Generated .groundatlas* reports remain evidence/navigation only, not SSOT.
• Native package release proof remains Release workflow + release:readback + npm registry readback/consumer smoke proof when package behavior changes.

Validation

• node --test test/project-control.node-test.mjs
• YAML parse for .github/workflows/ci.yml, test.yml, and release.yml
• npm exec --yes --package groundatlas@0.1.2 -- ga update --out .groundatlas-pilot
• npm exec --yes --package groundatlas@0.1.2 -- ga audit --out .groundatlas-pilot
• npm exec --yes --package groundatlas@0.1.2 -- ga manifest --out .groundatlas-pilot --json
• npm exec --yes --package groundatlas@0.1.2 -- ga fleet . --out .groundatlas-pilot --require-atlas --strict --json
• bun install --frozen-lockfile
• bun run release:readback

Native matrix proof is intentionally left to CI because this is a control-plane-only change and the repo already owns cross-platform native build gates.