docs: define Wyvern's resident release boundary

[hartsock]

Outcome

Establishes the truthful R0 baseline for the small resident/headless Wyvern release. It replaces the obsolete swarm-orchestrator charter, records exact cross-repository evidence and blockers, marks retained sortie code as legacy/non-release-path, and restores a locked pull-request CI gate.

This PR intentionally adds no resident runtime and makes no streaming, execution, or release-readiness claim.

R0 milestone

1. Current blocker: main's documentation and stub demo described a different product and its green in-memory tests could be mistaken for release evidence.
2. Owning repository: wyvern-agent.
3. Invariant closed: Wyvern's release role is the lightweight resident/headless Newt runtime; legacy orchestration types are not the task, execution, identity, or transport contract.
4. Proof: source-pinned inventory, explicit supported-axis matrix and release gates, plus the repository's locked format/lint/test/vendor guard in CI.
5. Next smallest step: land Newt's shared typed ResidentId/WorkspaceBinding in newt-agent#1701. Wyvern R1 code stays blocked rather than inventing persistence or crypto locally.

Changes

• Reframes the top-level README and charter around the resident product boundary.
• Adds docs/RELEASE_INVENTORY.md with exact inspected SHAs, existing/duplicated code, missing contracts, R0-R6 merge train, support matrix, and real acceptance script.
• Audits PR feat: the flight tier — lightest headless worker (v0.1) #43 as a non-release implementation because it directly invokes bash, buffers completion, bypasses Bridle, and duplicates Newt runtime pieces.
• Marks legacy orchestration crate docs/ADRs as retained history, not the resident API.
• Adds .github/workflows/ci.yml and keeps it in explicit parity with just check and the pre-push hook.
• Runs clippy/tests against Cargo.lock.

Owning dependency handoffs

• shared runtime: typed stable ResidentId and canonical WorkspaceBinding for headless consumers newt-agent#1701 — stable ResidentId + WorkspaceBinding
• protocol: bind a stable runtime-resident claim to ephemeral AgentKey certificates agent-mesh#85 — signed resident claim on ephemeral process keys
• execution: backend-neutral managed lifecycle with a real Local backend (RFC 5a) agent-bridle#370 — managed backend-neutral execution lifecycle
• bus: implement authenticated full-duplex session streams from the proposed ADR agent-mesh#84 — authenticated full-duplex sessions
• headless: structured one-task runtime over the shared Bridle lifecycle (Wyvern seam) newt-agent#1702 — structured headless one-task seam over Bridle

Release tracker: #51.

Exact R0 bases

• Wyvern: 2fb7107
• Newt: 4de556542abf22a4ef35c0b88e9d7588f5827744
• Agent Bridle: 5fe291ab38a04913dd5d8bc16134aaceb2f369af
• Agent Mesh: d3b2263ac0f932a10bfc209078885d32ec9e35b4

Verification

• just check
• cargo fmt --all -- --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace (32 unit tests, one integration guard, doc tests)
• cargo test --locked -p wyvern-wire --test no_vendor
• actionlint .github/workflows/ci.yml
• git diff --check

The pre-push hook reran the full gate successfully before the branch was published.

Risk

High: this deliberately corrects the product charter and adds CI/build-gate configuration. No Rust source, manifest, dependency, lockfile, execution path, or authority behavior changes. Human review/merge required.

---

Note

^{Cursor Bugbot is generating a summary for commit 63b189c. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_626cfc2e-dd9a-4ecc-a8d5-f15d48cf151c)